PT-2026-97312

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182200 and earlier Description A permissions validation issue exists that allows low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope. MBeans...

PT-2026-97306

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 Description An authentication bypass issue exists when the Application Manager Plugin is enabled, allowing an attacker to gain unauthorized access to the system. Recommendations Update to a...

CVE-2026-75825: Missing Authentication for Critical Function

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

CVE-2026-15358: Unquoted Search Path or Element

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

CVE-2026-86683: Improper Input Validation

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86678: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

PT-2026-97308

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 12.8.709 and earlier ManageEngine Firewall Analyzer versions 12.8.709 and earlier Description An XML Injection issue exists within the Rule Tracking Compare Policies feature. XML Injection occurs when an...

CVE-2026-12370: Improper Neutralization of Special Elements Used in a Template Engine

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

PT-2026-97318

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-76980: Improper Input Validation

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector...

CVE-2026-86677: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

PT-2026-97319

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can modify the proxy settings of the application. Recommendations Update to a version later than 182000...

PT-2026-97316

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can execute unauthorized SQL commands, which may lead to the attainment of administrator privileges and remote code execution RCE, a process where ...

PT-2026-97313

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182200 and earlier Description An exposure of a Google Cloud service-account private key exists within the installer. This flaw allows an unauthenticated attacker to impersonate the service account,...

CVE-2026-84789: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

PT-2026-97289

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.671 ManageEngine Network Configuration Manager versions prior to 12.8.671 Description An unauthorized Path Traversal issue exists, which allows an attacker to access files and directories outside t...

CVE-2026-84787: Execution with Unnecessary Privileges

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-14913: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

CVE-2026-76978: Improper Neutralization of Special Elements used in an OS Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

PT-2026-97296

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can bypass access controls to create alert notifications for...