CVE-2026-86679
Received Received - Intake

Permissions Validation Flaw in ManageEngine Applications Manager

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: ManageEngine

Description
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86679
EUVD
EUVD-2026-85293

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zoho manageengine_applications_manager to 182000 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZohoCorp ManageEngine Applications Manager versions 182000 and below had a permissions validation issue. This allowed a low-privileged user to delete service monitors that were outside their assigned scope, meaning they could remove monitoring for systems they were not authorized to manage.

Impact Analysis

This vulnerability could lead to unauthorized deletion of critical service monitors, disrupting monitoring and potentially causing unnoticed outages or performance issues in managed systems. It may also allow attackers to hide malicious activity by removing relevant monitoring alerts.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized deletion of service monitors, which may affect data integrity and availability. Unauthorized changes to monitoring configurations could lead to undetected breaches or failures to meet regulatory logging and monitoring requirements.

Mitigation Strategies

Update ZohoCorp ManageEngine Applications Manager to a version higher than 182000 to address the permissions validation issue. Restrict low-privileged user access to service monitors and review existing monitor configurations for unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart