ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 subTab or 2 tab parameter to createAnomaly.do; 3 url, 4 subTab, or 5 tab parameter to mindex.do; 6 tab parameter to index2.do; or 7 port...

CVE-2026-76979

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...

EUVD-2026-85269

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-76978 Command Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-76978 Command Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

EUVD-2026-85262

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84789 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

CVE-2026-84789 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

PT-2026-97297

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can modify Change Management report schedule configurations for...

PT-2026-97308

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 12.8.709 and earlier ManageEngine Firewall Analyzer versions 12.8.709 and earlier Description An XML Injection issue exists within the Rule Tracking Compare Policies feature. XML Injection occurs when an...

CVE-2026-84791: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

PT-2026-97288

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.670 ManageEngine Firewall Analyzer versions prior to 12.8.670 Description An SQL Injection issue exists in Rule Management Search Reports. SQL Injection is a technique where malicious SQL statement...

PT-2026-97307

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.710 ManageEngine Firewall Analyzer versions prior to 12.8.710 Description A command injection issue exists within the Diagnose Settings feature. Command injection is a flaw that allows an attacker ...

PT-2026-97296

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can bypass access controls to create alert notifications for...

CVE-2026-14913: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

PT-2026-97304

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An authenticated low-privilege user can gain Administrator privileges through the Report Profile import feature. This issue...

CVE-2026-76978: Improper Neutralization of Special Elements used in an OS Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-84787: Execution with Unnecessary Privileges

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...