CVE-2026-86681
Received Received - Intake

Unauthorized MBean Action Execution in Zoho ManageEngine Applications Manager

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: ManageEngine

Description
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86681
EUVD
EUVD-2026-85289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zoho manageengine_applications_manager to 182200 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZohoCorp ManageEngine Applications Manager versions 182200 and below had a permissions validation flaw. Low-privileged users could execute administrator-configured MBean actions on monitors outside their assigned scope.

Impact Analysis

An attacker with low privileges could perform unauthorized actions on monitors they should not access, potentially leading to data exposure, system manipulation, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations and penalties due to insufficient access controls.

Mitigation Strategies

Update ZohoCorp ManageEngine Applications Manager to versions above 182200 to address the permissions validation issue. Restrict low-privileged user access to MBean actions and review monitor scope assignments to prevent unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart