Am I vulnerable?
CVE-2026-6516 is an unauthenticated remote code execution flaw in Zohocorp's ManageEngine ADAudit Plus, an Active Directory change-auditing product that runs on Windows and connects to domain controllers with elevated read privileges. NVD scores it CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L), the maximum. An attacker who can reach the agent API over the network, with no credentials, can run OS commands on the host. If your ADAudit Plus server is on a build below 8606, treat it as vulnerable, regardless of whether the console is internet-facing.
Affected and fixed versions
| Component |
Vulnerable |
Fixed in |
| ADAudit Plus server |
All builds below 8606 |
Build 8606 |
| ADAudit Plus Windows agent |
Versions earlier than 7060 |
7060 or later |
| ADAudit Plus Mac agent |
All versions |
Latest available |
Diagnostic checks (read-only)
- Server build (web console): log in to the ADAudit Plus console and read the build number on the License or About screen. Vulnerable if it is below 8606.
- Deployed agents (web console): go to Configuration, then Agent Management, then Manage, and read the Installed Version column. Any Windows agent below 7060, and any Mac agent not on the latest version, needs upgrading.
- Server host (on disk): on the ADAudit Plus server, the build metadata lives in the product's installation directory under
C:\ManageEngine\ADAudit Plus\. Confirm the reported build is 8606 or higher.
- Exposure weighting: the highest-risk instances are those whose agent API or console is reachable from untrusted networks. An internet-exposed ADAudit Plus server sitting inside the AD trust boundary is the worst case.
Vulnerability
The vulnerability lives in the ADAudit Plus agent APIs. Per the vendor, an unauthenticated attacker can chain an authentication-bypass weakness with a path-traversal weakness to reach a code path that fails to neutralize OS command metacharacters, which NVD classifies as CWE-78 (OS command injection). The net effect is that a crafted request to the agent API results in arbitrary commands running as the ADAudit Plus service process on the Windows host.
The severity comes from where the product sits, not just the bug class. ADAudit Plus is trusted to monitor Active Directory, so it runs on a Windows server inside the domain trust boundary with a service account provisioned for directory-wide read access. Code execution on that host is therefore adjacent to the identity infrastructure of the environment. The S:C (scope changed) flag in the CVSS vector reflects that the impact does not stay contained to the vulnerable component.
ManageEngine products have been a recurring target once patches or proof-of-concept code appear. CISA and partner agencies documented nation-state exploitation of the ADSelfService Plus flaw CVE-2021-40539 (advisory AA21-259A), the Zoho SAML RCE CVE-2022-47966 saw confirmed active exploitation, and ADAudit Plus itself carried an unauthenticated XXE-to-RCE (CVE-2022-28219) fixed in build 7060. As of July 24, 2026 there is no public exploit, KEV listing, or in-the-wild report specific to CVE-2026-6516 in our sources, but the deployment shape and the vendor's history make this a patch-now item.
Threat model
Who would exploit this: the unauthenticated, network-reachable nature of the bug makes it attractive across the full operator spectrum. Opportunistic ransomware affiliates and initial-access brokers mass-scan for exposed management products because a single request yields code execution on a Windows server inside the AD trust boundary. State-aligned actors have a documented appetite for ManageEngine specifically (CVE-2021-40539, per CISA AA21-259A). Targeted criminals and espionage crews value the same box for the directory and credential access it fronts.
What they're after:
- Initial foothold on a Windows server inside the AD environment
- Theft of the ADAudit Plus service-account credentials and host secrets
- Lateral movement toward domain controllers and domain-admin escalation
- Persistence via web shells, scheduled tasks, or service-account abuse
- Exfiltration of directory and audit data, or espionage
- Ransomware staging
Attack chain: an attacker scans for reachable ADAudit Plus agent API endpoints and sends a crafted request that abuses the API to run an OS command as the service process, with no credentials. From that foothold they typically drop a web shell or loader for persistence, harvest credentials from the host and the auditing service account, and use the product's existing AD connectivity to enumerate the directory and pivot toward domain controllers. Because the service account commonly holds elevated domain-level rights, the path from foothold to broad AD compromise is short.
Blast radius: a compromised instance yields service-or-SYSTEM-level execution on a server already trusted to read Active Directory, plus a service account typically provisioned with elevated directory rights. That combination hands the attacker directory enumeration, credentials cached on the host, and a direct pivot toward domain controllers and domain admin, alongside any adjacent management and monitoring infrastructure the server can reach.
Mitigation
Patch
Update the server to build 8606 or later using the ADAudit Plus service pack, then upgrade the agents: Windows agents to 7060 or later, and all Mac agents to the latest version regardless of current version. The vendor lists no configuration workaround, so the upgrade is the fix.
Compensating controls
Until every component is patched, reduce exposure:
- Remove internet exposure. The agent API and web console should not be reachable from untrusted networks. Restrict access with a network firewall or ACL to trusted internal management ranges only.
- Segment the host. Place ADAudit Plus on a management network segmented from general user traffic, and limit what the server can reach outbound so a foothold cannot freely stage tooling or beacon out.
- Right-size the service account. Review the privileges granted to the ADAudit Plus service account and remove any beyond what auditing requires, to shrink the blast radius of a host compromise.
- Watch for anomalous child processes. Monitor for the ADAudit Plus service spawning shells or LOLBins and for unexpected outbound connections from the host (see Detection below).
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune false positives before deploying to production.
Network and log signals
- Unauthenticated POST requests to the ADAudit Plus agent API on its service port (commonly TCP 8081, or the configured web port) from external or non-management source IPs.
- Request URIs or bodies to agent API paths containing OS command-injection metacharacters:
;, |, &&, command substitution ($(...) or backticks), redirects (>), or CRLF-encoded payloads (%0a, %0d).
- Agent API request bodies referencing LOLBins or download utilities as string values:
cmd.exe, powershell, whoami, net, certutil, curl, bitsadmin, mshta, or nslookup.
- A spike in HTTP 200 responses on the agent API port from untrusted source IPs, especially a single source repeatedly hitting the same endpoint (retry or spray pattern).
- Outbound connections from the ADAudit Plus service process (
wrapper.exe or java.exe under C:\ManageEngine\ADAudit Plus\) to non-Zoho IP space, cloud VPS ranges, or raw IP:port pairs, shortly after inbound agent API traffic.
- DNS lookups from the host to newly-seen external domains correlated in time with inbound agent API POSTs.
YARA
rule CVE_2026_6516_ADAuditPlus_agent_cmdi_starter
{
meta:
description = "AI-generated STARTER rule: flags possible OS command-injection payloads against the ManageEngine ADAudit Plus agent API (CVE-2026-6516). Intended for scanning captured web-access logs, WAF logs, or reconstructed HTTP request bodies. VALIDATE before deploying."
author = "CVE Brief Deep Dive (AI-generated starter)"
reference = "CVE-2026-6516"
date = "2026-07-24"
cve = "CVE-2026-6516"
confidence = "low"
note = "No verified file hashes. Behavioral/string heuristic only; tune agent_path and metachars to your logging format. Expect false positives on legitimate agent traffic."
strings:
// Agent API path fragments (adjust to your build's actual endpoint)
$path1 = "/agent/" ascii nocase
$path2 = "ADAudit" ascii nocase
$path3 = "AgentAPI" ascii nocase
// Command-injection metacharacters / substitution
$meta1 = "$(" ascii
$meta2 = "%0a" ascii nocase
$meta3 = "%0d" ascii nocase
$meta4 = "|" ascii
$meta5 = ";" ascii
$meta6 = "&&" ascii
// LOLBins / download utilities commonly abused post-injection
$lol1 = "cmd.exe" ascii nocase
$lol2 = "powershell" ascii nocase
$lol3 = "certutil" ascii nocase
$lol4 = "bitsadmin" ascii nocase
$lol5 = "whoami" ascii nocase
$lol6 = "curl " ascii nocase
condition:
// A request touching an agent/ADAudit path that ALSO carries either
// injection metacharacters or an explicit LOLBin reference.
any of ($path*)
and (
2 of ($meta*)
or any of ($lol*)
)
}
Sigma
title: ManageEngine ADAudit Plus Agent Process Spawning Shell or LOLBin (Possible CVE-2026-6516 Exploitation)
id: a1b2c3d4-0000-0000-0000-000000000000
status: experimental
description: |
AI-generated STARTER rule. Detects the ManageEngine ADAudit Plus Java service process
(wrapper.exe or java.exe running from the ManageEngine ADAudit Plus install directory)
spawning a command shell or common LOLBin. This is the core behavioral signal of the
unauthenticated OS command injection RCE in the ADAudit Plus agent API (CVE-2026-6516,
CVSS 10.0, builds below 8606). Validate parent path and child list in your environment
before deploying.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-6516
author: CVE Brief Deep Dive (AI-generated starter)
date: 2026/07/24
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\ManageEngine\ADAudit Plus\'
ParentImage|endswith:
- '\wrapper.exe'
- '\java.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\whoami.exe'
- '\net.exe'
- '\net1.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\nslookup.exe'
condition: selection_parent and selection_child
falsepositives:
- ADAudit Plus legitimately spawns child processes for Active Directory data collection, scheduled reporting, agent management, and PowerShell-based AD queries; these can match the child list and must be baselined per environment.
- Administrative or diagnostic scripts run from the ADAudit Plus context.
- Product upgrades or installer activity invoking cmd.exe or PowerShell from the install directory.
level: high
Rule notes
The Sigma rule keys on the reliable behavioral signal (the ADAudit Plus java/wrapper parent spawning a shell or LOLBin child) and is medium-confidence, but it needs per-environment baselining because ADAudit Plus legitimately spawns some of these processes for AD collection. The YARA rule is a low-confidence log heuristic for command-injection metacharacters near agent API paths; tune the path and metacharacter strings to your actual access-log format to control false positives.
References