Description Summary:
ManageEngine ADAudit Plus is vulnerable to unauthenticated remote code execution due to a flaw in the agent API, which fails to properly neutralize OS commands.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in ManageEngine ADAudit Plus enables attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6516

Affected Software: Zohocorp ManageEngine ADAudit Plus

Affected Versions: 0 up to (excluding) 8606

Vulnerability: The vulnerability is categorized as an OS command injection flaw located within the agent API. It allows unauthenticated attackers to send specially crafted requests that result in the execution of arbitrary commands on the host server.

Business Impact

A successful exploit provides the attacker with full control over the server hosting ADAudit Plus. Because ADAudit Plus typically operates with elevated privileges to monitor Active Directory environments, this compromise could lead to lateral movement within the network, theft of sensitive credentials, and complete domain compromise. The CVSS score of 10.0 highlights the maximum severity of this vulnerability.

Remediation Plan

Immediate Action: Update ManageEngine ADAudit Plus to build 8606 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious child processes or unauthorized shell executions originating from the ADAudit Plus service account.

Compensating Controls: Use a network firewall to restrict access to the ADAudit Plus management interface and agent API to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws in management software are frequently targeted by attackers due to the high level of trust and privilege these applications hold in an enterprise environment.

Analyst Recommendation

This is a critical vulnerability that requires immediate remediation. All instances of ManageEngine ADAudit Plus must be updated to the latest version to prevent potential remote code execution. Security teams should prioritize this update as part of their urgent patch management lifecycle.

Description Summary:
Zohocorp ManageEngine PAM360 and Password Manager Pro contain an authenticated SQL injection vulnerability within the query report module.

Executive Summary:
An authenticated SQL injection vulnerability in Zohocorp ManageEngine PAM360 and Password Manager Pro allows an attacker to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-5785

Affected Software: Zohocorp ManageEngine PAM360 and Password Manager Pro

Affected Versions: ManageEngine PAM360: 0 up to 8531; Password Manager Pro: 8600 through 13230

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the query report module, which allows an authenticated user to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to read or modify sensitive data stored within the ManageEngine database. Given the nature of these products as privileged access management tools, the compromise of stored credentials and configuration data poses a critical risk to the entire organizational infrastructure. The CVSS score of 8.1 reflects the high potential for impact on confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade ManageEngine PAM360 to version 8531 or later, and update Password Manager Pro to the version specified in the vendor advisory.

Proactive Monitoring: Review database audit logs for unusual query patterns or unexpected attempts to access the query report module by standard user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the application endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the privilege level is low, making it a viable target for malicious insiders or compromised user accounts.

Analyst Recommendation

This vulnerability represents a significant risk due to the sensitive nature of the data managed by the affected software. Security teams should prioritize patching these instances immediately to prevent unauthorized data access. If an immediate update is not feasible, restrict access to the query report module to trusted administrative personnel only until the patch is applied.

Description Summary:
ManageEngine Exchange Reporter Plus contains a stored cross-site scripting (XSS) vulnerability in the Non-Owner Mailbox Permission report, allowing authenticated users to execute malicious scripts.

Executive Summary:
A stored cross-site scripting vulnerability in ManageEngine Exchange Reporter Plus enables authenticated attackers to execute arbitrary scripts within the context of a victim session.

Vulnerability Details

CVE-ID: CVE-2026-4108

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: This vulnerability is a stored cross-site scripting (CWE-79) flaw located within the Non-Owner Mailbox Permission report. It requires an authenticated user with low-level privileges to inject malicious scripts that execute when a victim views the affected report.

Business Impact

The ability for an attacker to execute arbitrary scripts in the context of an administrator or other user session poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to session hijacking, unauthorized access to sensitive mailbox reports, or the modification of application data. With a CVSS score of 7.3, this flaw is categorized as High severity due to the potential for impacting administrative sessions.

Remediation Plan

Immediate Action: Upgrade to version 5802 or later of ManageEngine Exchange Reporter Plus to apply the vendor-provided patch.

Proactive Monitoring: Review application access logs for suspicious input patterns within the Non-Owner Mailbox Permission report and monitor for unusual script execution activity in user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to inspect and sanitize incoming traffic to the application until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a logged-in user to trigger the malicious payload, which limits its reach compared to unauthenticated remote code execution flaws.

Analyst Recommendation

Given the High severity of this vulnerability, organizations should prioritize updating their ManageEngine Exchange Reporter Plus instances to version 5802 immediately. While the requirement for authentication reduces the immediate threat surface, the potential for privilege escalation and session compromise necessitates prompt remediation to maintain a secure environment.

Description Summary:
ManageEngine Exchange Reporter Plus is vulnerable to Stored Cross-Site Scripting (XSS) within the Folder Message Count and Size report, allowing for potential malicious script injection.

Executive Summary:
A Stored XSS vulnerability in ManageEngine Exchange Reporter Plus, identified as CVE-2026-4107, poses a risk of unauthorized script execution and potential session compromise for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-4107

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: The application is susceptible to a Stored Cross-Site Scripting (XSS) flaw in the Folder Message Count and Size report. This vulnerability requires a low-privileged authenticated attacker to inject malicious scripts that execute in the context of an unsuspecting user session.

Business Impact

The successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the browser of an authenticated user, leading to session hijacking, unauthorized actions, or information disclosure. With a CVSS score of 7.3, the vulnerability is classified as High, reflecting the significant impact on data integrity and user confidentiality within the administrative environment.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later as specified in the official vendor advisory.

Proactive Monitoring: Review web application access logs for suspicious input patterns, specifically those containing script tags or encoded characters within reporting parameters.

Compensating Controls: Implement or tune a Web Application Firewall (WAF) to detect and block malicious script payloads targeting common reporting endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for user interaction and authentication limits its initial attack surface, though it remains a significant risk once a target session is compromised.

Analyst Recommendation

Given the High severity rating, organizations should prioritize the application of the vendor-provided patch to remediate the vulnerability. Failure to update may expose internal administrative sessions to malicious activity, and patching should be conducted as part of the next standard maintenance cycle or sooner if the environment is highly exposed.

Description Summary:
Zohocorp ManageEngine Exchange Reporter Plus is vulnerable to stored cross-site scripting (XSS) within the Public Folder Client Permissions report.

Executive Summary:
A stored cross-site scripting vulnerability in ManageEngine Exchange Reporter Plus allows authenticated attackers to execute arbitrary scripts in the context of a victim's browser session.

Vulnerability Details

CVE-ID: CVE-2026-3880

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: Zohocorp ManageEngine Exchange Reporter Plus: 0 up to (excluding) 5802

Vulnerability: The application is susceptible to stored cross-site scripting (CWE-79) via the Public Folder Client Permissions report. Successful exploitation requires a low-privileged authenticated user to inject malicious scripts that execute when an administrator or another user views the report.

Business Impact

This vulnerability carries a CVSS score of 7.3, indicating a high severity level. Successful exploitation could lead to unauthorized actions performed on behalf of the victim, potentially resulting in session hijacking, data theft, or the modification of sensitive reporting configurations.

Remediation Plan

Immediate Action: Upgrade to ManageEngine Exchange Reporter Plus version 5802 or later as specified in the official vendor advisory.

Proactive Monitoring: Review application access logs for unusual patterns or characters in report parameters and monitor for unauthorized script execution alerts from endpoint protection software.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS attacks and enforce strict Content Security Policy (CSP) headers.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, stored XSS flaws are frequently targeted for account takeover and persistence.

Analyst Recommendation

Given the potential for session compromise and the high CVSS severity rating, administrators should prioritize updating to version 5802 immediately. Ensuring that all users have the latest security patches is the most effective way to eliminate this risk and protect the integrity of the Exchange reporting environment.

Description Summary:
ManageEngine Exchange Reporter Plus is vulnerable to stored cross-site scripting (XSS) via the Equipment Mailbox Details report, allowing authenticated users to execute malicious scripts.

Executive Summary:
A stored cross-site scripting vulnerability in ManageEngine Exchange Reporter Plus allows authenticated attackers to inject malicious scripts, potentially leading to unauthorized actions or data access.

Vulnerability Details

CVE-ID: CVE-2026-3879

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: The application is susceptible to stored cross-site scripting (CWE-79) within the Equipment Mailbox Details report. An authenticated attacker with low privileges can inject arbitrary JavaScript that executes in the context of another user's session when they view the compromised report.

Business Impact

Successful exploitation of this vulnerability could lead to session hijacking or unauthorized administrative actions performed on behalf of a victim. Given the CVSS score of 7.3, this represents a high risk to organizational security, as it facilitates the compromise of user accounts and potentially sensitive administrative data stored within the reporting interface.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine Exchange Reporter Plus to build 5802 or later as specified in the official vendor advisory.

Proactive Monitoring: Monitor web access logs for unusual patterns, such as suspicious script tags or encoded characters being submitted to the reporting module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads targeting the reporting endpoints until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated user to successfully inject the payload, which limits the attack surface to existing platform users.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of the Exchange Reporter Plus environment. Security administrators should prioritize the deployment of the vendor-provided update to version 5802 immediately to eliminate the underlying injection flaw and protect against potential session-based attacks.

Description Summary:
ManageEngine Log360 versions 13000 through 13013 contain an authentication bypass vulnerability due to an improper filter configuration on specific actions.

Executive Summary:
An authentication bypass vulnerability in Zohocorp ManageEngine Log360 allows unauthenticated attackers to perform unauthorized actions, posing a significant risk to centralized log management security.

Vulnerability Details

CVE-ID: CVE-2026-3324

Affected Software: Zohocorp ManageEngine Log360

Affected Versions: 13000 through 13013

Vulnerability: The software suffers from an authentication bypass (CWE-288) caused by improper filter configuration. This flaw permits an unauthenticated attacker to interact with specific application actions without valid credentials.

Business Impact

The vulnerability carries a CVSS score of 8.2, classifying it as High severity. Successful exploitation allows unauthorized parties to influence sensitive log management operations, potentially leading to the modification of security data, audit log manipulation, or unauthorized access to system configuration. Such compromise undermines the integrity of the entire security monitoring infrastructure.

Remediation Plan

Immediate Action: Review the official ManageEngine security advisory and apply the provided security updates as soon as they become available. If a patch is not yet released, restrict network access to the Log360 interface to trusted management subnets only.

Proactive Monitoring: Monitor application access logs for unusual patterns, such as multiple requests to sensitive endpoints originating from unauthorized or unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to intercept and block traffic attempting to access administrative endpoints without proper authentication headers or tokens.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous because it is remotely exploitable without authentication, making it an attractive target for automated scanning and exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability allowing unauthenticated access, this issue should be treated as a priority. Administrators must prioritize applying vendor-supplied patches to all affected instances of ManageEngine Log360 to prevent potential unauthorized system manipulation.

Description Summary:
ManageEngine Exchange Reporter Plus is vulnerable to a Stored Cross-Site Scripting (XSS) attack within the Permissions based on Distribution Groups report.

Executive Summary:
A Stored XSS vulnerability in Zohocorp ManageEngine Exchange Reporter Plus allows authenticated users to inject malicious scripts into reports, posing a risk of session hijacking or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-28756

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: This is a Stored Cross-Site Scripting (CWE-79) vulnerability that occurs when the application fails to properly sanitize input within the Permissions based on Distribution Groups report. The vulnerability requires an authenticated user with low privileges to trigger the payload when a victim views the affected report.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high potential for impact on confidentiality and integrity. Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an administrator session, potentially leading to unauthorized system changes, data exfiltration, or complete administrative account compromise. Such incidents result in significant reputational damage and potential loss of sensitive organizational messaging metadata.

Remediation Plan

Immediate Action: Update Zohocorp ManageEngine Exchange Reporter Plus to build 5802 or later as specified in the official vendor security advisory.

Proactive Monitoring: Review application access logs for unusual patterns or characters in report parameters and monitor for unauthorized script execution within the browser sessions of administrative users.

Compensating Controls: Implement a strict Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter malicious payloads from incoming HTTP requests while the update is being prepared for deployment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it relies on the trust placed in the reporting interface, which administrators frequently access.

Analyst Recommendation

Given the high CVSS score and the nature of Stored XSS in an enterprise reporting tool, this vulnerability represents a significant risk to administrative account security. Administrators should prioritize the installation of build 5802 immediately to neutralize the injection vector. Continued reliance on unpatched versions of this software exposes the internal environment to potential script-based attacks against high-privilege users.

Description Summary:
Zohocorp ManageEngine Exchange Reporter Plus is affected by a stored cross-site scripting (XSS) vulnerability within the Distribution Lists report functionality.

Executive Summary:
A stored cross-site scripting vulnerability in ManageEngine Exchange Reporter Plus allows authenticated attackers to execute malicious scripts in the context of a victim's session.

Vulnerability Details

CVE-ID: CVE-2026-28754

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: The application fails to properly neutralize user-supplied input within the Distribution Lists report, leading to stored cross-site scripting (CWE-79). The CVSS vector (PR:L, UI:R) indicates that an authenticated user must trigger the execution of the malicious script by viewing the compromised report.

Business Impact

The exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of an administrator, or the theft of sensitive session tokens. Given the 7.3 CVSS score, this represents a significant risk to the integrity and confidentiality of the Exchange reporting environment. Successful exploitation may result in the compromise of administrative accounts, potentially leading to broader unauthorized access within the reporting infrastructure.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later to address the input neutralization flaw.

Proactive Monitoring: Review web server and application access logs for unusual patterns or payloads within the Distribution Lists report module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common cross-site scripting injection strings.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication and user interaction, the potential impact on reporting data and administrative sessions remains high.

Analyst Recommendation

Organizations utilizing ManageEngine Exchange Reporter Plus should prioritize patching to version 5802 immediately to eliminate this injection vector. Given the nature of stored XSS, the risk persists as long as malicious payloads remain in the system database; therefore, applying the vendor-supplied update is the only definitive path to remediation.

Description Summary:
ManageEngine Exchange Reporter Plus versions before 5802 are susceptible to a stored cross-site scripting vulnerability within the Mails Exchanged Between Users report.

Executive Summary:
A stored cross-site scripting vulnerability in ManageEngine Exchange Reporter Plus could allow an authenticated attacker to execute malicious scripts in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2026-28703

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: The application fails to properly neutralize user-supplied input within the Mails Exchanged Between Users report, leading to CWE-79 (Stored XSS). This flaw requires an authenticated user with low privileges to trigger the execution of malicious scripts when a victim views the affected report.

Business Impact

Successful exploitation allows an attacker to inject arbitrary scripts that execute when an authorized user accesses the report, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity of administrative sessions and internal communication data.

Remediation Plan

Immediate Action: Update Zohocorp ManageEngine Exchange Reporter Plus to version 5802 or later as specified in the vendor advisory.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious script tags being submitted to report-related parameters.

Compensating Controls: Implement a strict Web Application Firewall (WAF) policy to block suspicious script injections and restrict access to the reporting module to authorized personnel only.

Exploitation Status

Public Exploit Available: exploit_available (false)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for a low-privileged account to trigger the stored payload limits the immediate attack surface for unauthenticated actors.

Analyst Recommendation

Given the potential for session compromise and the high CVSS score, organizations should prioritize upgrading their ManageEngine Exchange Reporter Plus installations to version 5802. Prompt patching is the most effective method to eliminate this cross-site scripting risk and protect sensitive user sessions from potential script injection attacks.

Description Summary:
ManageEngine Exchange Reporter Plus is vulnerable to Stored Cross-Site Scripting (XSS) via the Permissions Based on Mailboxes report, allowing for potential malicious script injection.

Executive Summary:
A Stored Cross-Site Scripting vulnerability in Zohocorp ManageEngine Exchange Reporter Plus allows authenticated users to inject malicious scripts, potentially leading to unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-27655

Affected Software: Zohocorp ManageEngine Exchange Reporter Plus

Affected Versions: 0 up to (excluding) 5802

Vulnerability: This is a Stored Cross-Site Scripting (CWE-79) vulnerability located within the Permissions Based on Mailboxes report. The attack requires the attacker to be an authenticated user with low privileges to successfully inject malicious scripts into the application.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of an administrator or other user session. This may result in the theft of session cookies, unauthorized access to sensitive mailbox permissions data, or the performance of unauthorized actions on behalf of the victim. Given the CVSS score of 7.3, this is categorized as a High severity issue that poses a significant risk to the integrity and confidentiality of the reporting interface.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine Exchange Reporter Plus to build 5802 or later to address the vulnerability.

Proactive Monitoring: Review application access logs for unusual activity or suspicious script patterns originating from the Permissions Based on Mailboxes report module.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious payloads associated with XSS attacks until the patch can be applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is classified as High severity, it requires an authenticated user to initiate the attack, which limits the initial attack surface.

Analyst Recommendation

Security teams should prioritize updating the ManageEngine Exchange Reporter Plus instance to version 5802 or later. Given the nature of Stored XSS, failing to patch could allow for persistent threats within the administrative interface. Please verify the update against the official Zohocorp security advisory to ensure complete remediation of the affected component.

Description Summary:
Zohocorp ManageEngine products contain a command injection vulnerability in agent machines due to a third-party dependency, allowing authenticated remote code execution.

Executive Summary:
A critical command injection vulnerability in Zohocorp ManageEngine products permits authenticated remote code execution, posing a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-2740

Affected Software: Zohocorp ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus

Affected Versions: ADSelfService Plus < 6525; DataSecurity Plus < 6264; RecoveryManager Plus < 6313

Vulnerability: This is a command injection vulnerability (CWE-77) triggered by a flaw in a third-party dependency. While the CVSS score is 8.4, the vulnerability requires low privileges (authenticated) to execute arbitrary commands on agent machines.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on agent machines, potentially leading to full system compromise, lateral movement within the network, and the theft of sensitive data. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Update ADSelfService Plus to 6525 or later, DataSecurity Plus to 6264 or later, and RecoveryManager Plus to 6313 or later as specified by the vendor advisory.

Proactive Monitoring: Monitor agent machine logs for unexpected process execution or abnormal command-line activity indicative of injection attempts.

Compensating Controls: Restrict network access to management agents to trusted administrative segments to limit the potential pool of authenticated attackers.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is restricted by the requirement for authenticated access to the system.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators should prioritize patching all affected ManageEngine instances to prevent potential unauthorized code execution and secure their environment against exploitation.

Description Summary:
ManageEngine M365 Manager Plus and Security Plus are affected by an authenticated path traversal vulnerability in the Exchange Online backup module.

Executive Summary:
ManageEngine M365 Manager Plus and Security Plus are vulnerable to an authenticated path traversal flaw that allows authorized users to perform unauthorized file operations.

Vulnerability Details

CVE-ID: CVE-2026-16053

Affected Software: Zohocorp ManageEngine M365 Manager Plus, M365 Security Plus

Affected Versions: 0 up to (excluding) 4820

Vulnerability: This is a relative path traversal vulnerability (CWE-23) within the Exchange Online backup module, requiring an authenticated user to exploit the flaw.

Business Impact

With a CVSS score of 8.5, this vulnerability presents a significant risk to organizational security, as it allows an authenticated user to bypass file restrictions and potentially impact system availability or data integrity. The ability to manipulate system paths through the backup module could be leveraged for privilege escalation or lateral movement within the M365 management environment.

Remediation Plan

Immediate Action: Update both ManageEngine M365 Manager Plus and M365 Security Plus to build 4820 or higher to remediate the vulnerability.

Proactive Monitoring: Review audit logs for unusual activity involving the Exchange Online backup module and monitor for attempts to access unexpected file paths by authenticated users.

Compensating Controls: Limit access to the administrative console of M365 Manager/Security Plus to trusted personnel only and enforce the principle of least privilege to minimize the risk of compromised accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the high CVSS score highlights the potential for significant impact to managed M365 environments.

Analyst Recommendation

Administrators should treat this as a high priority update given the 8.5 CVSS score and the critical nature of the affected software. Applying the update to version 4820 is the only definitive way to mitigate the risk of path traversal within the backup module.

Description Summary:
Zohocorp ManageEngine products are vulnerable to an authenticated SQL injection flaw, which may allow an attacker with low-level privileges to manipulate database queries.

Executive Summary:
An authenticated SQL injection vulnerability in Zohocorp ManageEngine products allows low-privileged attackers to execute unauthorized database commands, posing a significant risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-14828

Affected Software: Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus

Affected Versions: Password Manager Pro (before 13235), PAM360 (before 8561), and Access Manager Plus (before 4405)

Vulnerability: The vulnerability is a SQL injection flaw (CWE-89) triggered by improper neutralization of special elements in SQL commands. The CVSS vector PR:L indicates that the attacker must have low-level privileges to successfully exploit the vulnerability.

Business Impact

The ability to perform SQL injection against a privileged management tool like Password Manager Pro or PAM360 creates a severe risk of total compromise. An attacker could extract sensitive credentials, modify administrative configurations, or disrupt core business operations, leading to potential data breaches and regulatory non-compliance. With a CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent unauthorized lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade all instances of Password Manager Pro to 13235, PAM360 to 8561, and Access Manager Plus to 4405 immediately.

Proactive Monitoring: Review database access logs for anomalous query patterns, such as unexpected syntax or unauthorized access attempts from standard user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to provide a layer of protection until patching is complete.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the nature of this flaw in a high-value target makes it a prime candidate for future weaponization.

Analyst Recommendation

Given the central role these products play in enterprise credential and access management, the risk posed by this SQL injection vulnerability is substantial. Administrators must prioritize the application of the vendor-provided security patches to all affected environments as soon as possible. Failure to remediate could allow an authenticated attacker to gain unauthorized control over the most sensitive assets managed by these systems.

Description Summary:
ManageEngine ADSelfService Plus is vulnerable to an authenticated SQL injection flaw in the search report option, allowing potential database manipulation by authenticated users.

Executive Summary:
A high severity SQL injection vulnerability in Zohocorp ManageEngine ADSelfService Plus, affecting versions 6522 and below, poses a significant risk of unauthorized data access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-1367

Affected Software: Zohocorp ManageEngine ADSelfService Plus

Affected Versions: 0 up to (excluding) 6523

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) within the search report functionality. It requires the attacker to possess authenticated access to the application to trigger the malicious SQL commands.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the underlying database, potentially leading to the theft of sensitive identity data or unauthorized modification of system records. With a CVSS score of 8.3, this flaw is categorized as High severity, reflecting the critical nature of the compromised information typically managed by ADSelfService Plus.

Remediation Plan

Immediate Action: Update Zohocorp ManageEngine ADSelfService Plus to build 6523 or later as specified in the official vendor advisory.

Proactive Monitoring: Review application and database logs for anomalous query patterns or unauthorized access attempts originating from authenticated service accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of February 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires authentication, the potential for total data impact makes this a high priority for remediation.

Analyst Recommendation

Given the high CVSS score and the sensitive nature of the data stored within ADSelfService Plus, organizations should prioritize patching this vulnerability immediately. Administrators must ensure that all instances are updated to version 6523 or higher to prevent potential exploitation by malicious actors who may gain access to low-privilege user credentials.

Description Summary:
An authentication bypass vulnerability in the ManageEngine DDI Central password reset workflow allows remote attackers to perform full account takeover.

Executive Summary:
A critical authentication bypass in ManageEngine DDI Central allows unauthenticated attackers to gain unauthorized access and compromise administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-12571

Affected Software: Zoho Corporation ManageEngine DDI Central

Affected Versions: 0 up to (excluding) 6201

Vulnerability: This vulnerability involves an improper authentication mechanism within the password recovery process. It allows an unauthenticated attacker to manipulate the workflow and take over legitimate user accounts.

Business Impact

Successful exploitation of this flaw grants an attacker full control over the affected ManageEngine DDI Central instance. Given the CVSS score of 9.8, this represents a critical risk: it could lead to total system compromise, unauthorized data exfiltration, and the manipulation of network infrastructure configurations.

Remediation Plan

Immediate Action: Upgrade to version 6201 or later immediately to resolve the authentication vulnerability.

Proactive Monitoring: Review system logs for suspicious password reset requests or multiple unauthorized access attempts originating from unusual sources.

Compensating Controls: Ensure that the management interface is not exposed to the public internet and restrict access to authorized network segments only.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its remote, unauthenticated nature and the high technical impact associated with account takeover.

Analyst Recommendation

This vulnerability presents a severe risk to organizational infrastructure due to the potential for complete system takeover. Administrators must prioritize updating ManageEngine DDI Central to version 6201 or higher as the primary and most effective mitigation strategy.

Description Summary:
ManageEngine Password Manager Pro and PAM360 are vulnerable to authentication bypass due to improper SAML signature verification, allowing unauthorized access to the application.

Executive Summary:
An authentication bypass vulnerability in Zohocorp ManageEngine products allows attackers to circumvent security controls due to flawed SAML signature validation.

Vulnerability Details

CVE-ID: CVE-2026-12263

Affected Software: Zohocorp ManageEngine Password Manager Pro, Zohocorp ManageEngine PAM360

Affected Versions: Password Manager Pro prior to 13232, PAM360 prior to 8551

Vulnerability: The vulnerability stems from improper verification of cryptographic signatures (CWE-347) within the SAML implementation. An attacker can craft malicious SAML assertions to bypass authentication mechanisms and gain unauthorized access to the application.

Business Impact

The CVSS score of 8.8 underscores the gravity of this authentication bypass in products designed for privileged access management. Unauthorized access to these platforms could grant an attacker control over highly sensitive credentials, leading to widespread compromise of the entire enterprise infrastructure.

Remediation Plan

Immediate Action: Update ManageEngine Password Manager Pro to version 13232 or higher, and PAM360 to version 8551 or higher, immediately.

Proactive Monitoring: Audit authentication logs for suspicious login activity or unauthorized access attempts occurring via SAML identity providers.

Compensating Controls: If immediate patching is not feasible, restrict network access to the management interfaces of these applications to known trusted IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it a high-value target for attackers looking to gain administrative access to privileged accounts.

Analyst Recommendation

Given that these tools manage the most sensitive credentials in an organization, this update is critical. Administrators must apply the patches immediately and verify the integrity of their SAML configurations to prevent unauthorized access.

Description Summary:
Zohocorp ManageEngine Password Manager Pro and PAM360 are vulnerable to an authenticated SQL injection flaw, which could allow an attacker to execute arbitrary SQL commands.

Executive Summary:
An authenticated SQL injection vulnerability in Zohocorp ManageEngine products allows attackers with low privileges to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-11840

Affected Software: Zohocorp ManageEngine Password Manager Pro and PAM360

Affected Versions: Password Manager Pro versions prior to 13232, PAM360 versions prior to 8552

Vulnerability: This is an SQL injection vulnerability (CWE-89) triggered by improper input sanitization. The vulnerability requires the attacker to have authenticated access (PR:L) to the system to exploit the flaw.

Business Impact

Successful exploitation permits an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification of sensitive administrative credentials, or full system compromise. With a CVSS score of 8.8, this high-severity vulnerability poses a significant risk to the security of privileged access management environments, where the confidentiality and integrity of stored secrets are paramount.

Remediation Plan

Immediate Action: Administrators must upgrade ManageEngine Password Manager Pro to version 13232 or higher, and PAM360 to version 8552 or higher immediately.

Proactive Monitoring: Review database access logs for anomalous query patterns, specifically those containing unexpected SQL syntax or unauthorized access attempts to sensitive tables.

Compensating Controls: Ensure that the database service account operates with the principle of least privilege, limiting its ability to execute administrative or system-level commands, and utilize a Web Application Firewall to filter malicious SQL payloads.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently associated with known exploits, the nature of the flaw makes it a high-value target for attackers seeking to gain persistent access to administrative credentials.

Analyst Recommendation

Given the critical role of these products in managing organizational secrets, the risk of credential exposure is severe. Organizations should prioritize patching these systems within their next maintenance window to prevent potential unauthorized access to the underlying database.

Description Summary:
Predictable SSO tickets in ManageEngine ADSelfService Plus and related products allow unauthenticated attackers to perform account takeover.

Executive Summary:
An unauthenticated account takeover vulnerability in ManageEngine products allows attackers to predict SSO tickets and hijack user sessions.

Vulnerability Details

CVE-ID: CVE-2026-11374

Affected Software: Zoho ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus

Affected Versions: See vendor advisory

Vulnerability: The Single Sign-On (SSO) ticket generation mechanism in these applications is cryptographically weak, allowing an unauthenticated attacker to predict valid session tokens. This enables unauthorized access to user sessions and complete account takeover.

Business Impact

The CVSS score of 9.0 underscores the extreme risk this vulnerability poses to identity management and access control. Because these products often manage privileged enterprise accounts, successful exploitation could grant an attacker high-level access to the Active Directory environment, leading to total organizational domain compromise.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Zoho for all affected ManageEngine products immediately.

Proactive Monitoring: Monitor authentication logs for suspicious or high-frequency login patterns that may indicate automated SSO ticket prediction or session hijacking attempts.

Compensating Controls: Disable external/internet-facing access to the affected ManageEngine portals and require multi-factor authentication (MFA) where supported to add a layer of protection against session hijacking.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, the risk to identity infrastructure is critical.

Analyst Recommendation

This vulnerability is highly dangerous due to its potential to facilitate identity-based attacks. Administrators must prioritize patching these ManageEngine components immediately to secure the identity perimeter and prevent unauthorized access to sensitive directory services.

Description Summary:
Zohocorp ManageEngine Analytics Plus is vulnerable to authenticated SQL injection via the key update API, potentially allowing unauthorized database operations by an authenticated user.

Executive Summary:
An authenticated SQL injection vulnerability in Zohocorp ManageEngine Analytics Plus poses a high risk of database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-9428

Affected Software: Zohocorp ManageEngine Analytics Plus

Affected Versions: 0 through 6171

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the key update API. This flaw requires the attacker to hold valid user credentials to interact with the vulnerable endpoint.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 8.3, this represents a high-severity risk that could lead to full data exfiltration, modification of sensitive business records, or potential service disruption.

Remediation Plan

Immediate Action: Review the official ManageEngine security advisory for the availability of a patch and apply it immediately to all affected instances.

Proactive Monitoring: Monitor database query logs for unusual syntax, unexpected error patterns, or unauthorized access attempts originating from the key update API.

Compensating Controls: Implement strict database access controls and use a Web Application Firewall (WAF) to filter malicious SQL payloads directed at the application API.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, the potential for total impact on the database necessitates prompt attention.

Analyst Recommendation

Due to the high CVSS severity and the critical nature of the ManageEngine platform, administrators should prioritize identifying all instances running version 6171 or earlier. Verify the status of the vendor patch and deploy it across the environment without delay to prevent unauthorized database interaction.

Description Summary:
Zohocorp ManageEngine Applications Manager is vulnerable to authenticated command injection via the execute program action feature, allowing arbitrary command execution.

Executive Summary:
An authenticated command injection vulnerability in Zohocorp ManageEngine Applications Manager allows remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-9223

Affected Software: Zohocorp ManageEngine Applications Manager

Affected Versions: 0 up to (excluding) 178200

Vulnerability: The application improperly neutralizes special elements in the execute program action feature, which allows an authenticated user with sufficient privileges to inject and execute arbitrary system commands.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. Successful exploitation could lead to unauthorized data access, complete loss of system integrity, and potential lateral movement within the network, significantly impacting business operations and data security.

Remediation Plan

Immediate Action: Update Zohocorp ManageEngine Applications Manager to version 178200 or later as specified in the vendor security advisory.

Proactive Monitoring: Review audit logs for suspicious execution of system processes or anomalous activity originating from the application service account.

Compensating Controls: Restrict access to the management console to authorized administrative subnets and implement strict egress filtering to prevent the application from initiating unauthorized connections.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of November 13, 2025, there is no public information indicating active exploitation in the wild. While the vulnerability requires authentication, the ability to execute arbitrary commands makes this a high-priority item for organizations using this platform.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, internal security teams should prioritize patching this vulnerability immediately. Ensure that administrative access to the ManageEngine interface is restricted to trusted personnel to mitigate the risk of exploitation by compromised user accounts.

Description Summary:
ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain a missing authorization vulnerability in the initiate remote session functionality, allowing for potential unauthorized access.

Executive Summary:
Zohocorp ManageEngine privileged access management products are vulnerable to an authorization bypass in remote session initiation, posing a high risk of unauthorized administrative actions.

Vulnerability Details

CVE-ID: CVE-2025-11669

Affected Software: Zohocorp ManageEngine PAM360, Password Manager Pro, and Access Manager Plus

Affected Versions: PAM360 versions before 8202, Password Manager Pro versions before 13221, and Access Manager Plus versions prior to 4401.

Vulnerability: This is a missing authorization flaw (CWE-862) occurring within the initiate remote session functionality. The vulnerability requires the attacker to have low-level privileges, as indicated by the CVSS vector (PR:L), to trigger the flaw.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high severity risk. Successful exploitation could allow an authenticated attacker to bypass authorization controls, potentially gaining unauthorized access to sensitive remote sessions managed by the platform. This leads to significant risks regarding data confidentiality and integrity, as well as potential regulatory non-compliance regarding privileged access management.

Remediation Plan

Immediate Action: Administrators must update their instances to the specified fixed versions: PAM360 version 8202 or later, Password Manager Pro version 13221 or later, and Access Manager Plus version 4401 or later.

Proactive Monitoring: Security teams should monitor system access logs for anomalous remote session initiation requests, particularly those originating from unexpected user accounts or unusual network segments.

Compensating Controls: Ensure that access to the ManageEngine web interface is restricted to authorized networks via VPN or firewall rules to limit the exposure of the management portal to unauthorized users.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of January 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of the software, which is designed to handle administrative credentials and high-value infrastructure sessions.

Analyst Recommendation

Given the critical role of privileged access management software in enterprise security, this vulnerability presents a significant risk to the entire IT infrastructure. Organizations should prioritize the application of the vendor-provided patches immediately to prevent potential privilege escalation or unauthorized remote access. Failure to remediate could allow an attacker to compromise the integrity of the administrative sessions managed by these tools.

Description Summary:
ManageEngine ADSelfService Plus versions before 6519 contain an authentication bypass vulnerability stemming from improper filter configurations.

Executive Summary:
An authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus allows unauthorized actors to circumvent security controls.

Vulnerability Details

CVE-ID: CVE-2025-11250

Affected Software: Zohocorp ManageEngine ADSelfService Plus

Affected Versions: before 6519

Vulnerability: The vulnerability is caused by improper filter configurations that fail to correctly validate session or authentication tokens, allowing attackers to bypass authentication requirements and gain unauthorized access to the application.

Business Impact

The ability to bypass authentication in a centralized identity and self-service management platform is catastrophic. With a CVSS score of 9.1, this vulnerability allows attackers to gain unauthorized administrative or user-level access, potentially leading to identity theft, unauthorized account management, and widespread privilege escalation across the network.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine ADSelfService Plus to build 6519 or the latest available version provided by the vendor.

Proactive Monitoring: Review application audit logs for unauthorized administrative sessions or access attempts originating from unexpected IP addresses.

Compensating Controls: Restrict access to the ADSelfService Plus portal to trusted network segments or VPNs only until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypass vulnerabilities in identity management software are high-priority targets. Organizations must treat this as an emergency update and verify that their instance of ADSelfService Plus is upgraded to version 6519 or later to prevent unauthorized system access.

Description Summary:
Zohocorp ManageEngine ADManager Plus versions prior to 8024 contain a command injection vulnerability within the Custom Script component that allows for arbitrary command execution by authenticated users.

Executive Summary:
A critical command injection vulnerability in Zohocorp ManageEngine ADManager Plus allows authenticated attackers to achieve remote code execution on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2025-10020

Affected Software: Zohocorp ManageEngine ADManager Plus

Affected Versions: 0 up to (excluding) 8024

Vulnerability: This vulnerability is a command injection flaw (CWE-77) located in the Custom Script component. It requires an authenticated user with sufficient privileges to interact with the component to execute unauthorized system commands.

Business Impact

The ability for an authenticated user to perform command injection poses a severe risk to organizational security, as it can lead to full system compromise, lateral movement within the network, and unauthorized access to sensitive Active Directory data. With a CVSS score of 8.5, this high-severity vulnerability represents a significant threat to internal infrastructure and operational integrity.

Remediation Plan

Immediate Action: Upgrade Zohocorp ManageEngine ADManager Plus to build 8024 or later to apply the vendor-supplied security patch.

Proactive Monitoring: Review system and application logs for unexpected process execution, unusual command-line arguments, or unauthorized modifications to system scripts.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users with permissions to access the Custom Script component until the patch is successfully applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the impact is severe, necessitating prompt patching to prevent potential misuse of legitimate user credentials.

Analyst Recommendation

Given the high-severity nature of command injection flaws and the potential for total system compromise, organizations should prioritize updating their ManageEngine ADManager Plus environments. Administrators must ensure that the update is applied immediately to eliminate the underlying vulnerability and reduce the risk of unauthorized system-level command execution.