CVE-2026-76979
Received Received - Intake

XML Injection in Zoho ManageEngine OpManager and Firewall Analyzer

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: ManageEngine

Description
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-76979
EUVD
EUVD-2026-85266

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zoho manageengine_opmanager to 12.8.709 (exc)
zoho firewall_analyzer to 12.8.709 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML Injection flaw in ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below. It specifically affects the Rule Tracking Compare Policies feature, allowing attackers to inject malicious XML code.

Impact Analysis

An attacker could exploit this to manipulate XML data, potentially leading to unauthorized access, data theft, or system disruption. The high severity score (7.7) indicates significant risk if exploited.

Compliance Impact

This vulnerability could potentially lead to unauthorized data access or manipulation, which may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by exposing sensitive information or violating data integrity requirements.

Mitigation Strategies

Update ZohoCorp ManageEngine OpManager and Firewall Analyzer to versions above 12.8.709 to address the XML Injection vulnerability in the Rule Tracking Compare Policies feature.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart