Zohocorp Manageengine Applications Manager vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Zohocorp Manageengine Applications Manager: 9 record(s), with affected versions and fixes.cpe:2.3:a:zohocorp:manageengine_applications_manager
CVE-2026-86708
Critical · 10.0
CWE-321 Sep 23, 2026
Sensitive data exposure
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
CVE-2026-86683
High · 8.1
CWE-20 Sep 23, 2026
Broken Authentication Vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
CVE-2026-86681
High · 7.6
CWE-306 Sep 23, 2026
Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
CVE-2026-86679
High · 7.1
CWE-20 Sep 23, 2026
Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
CVE-2026-86678
High · 8.8
CWE-639 Sep 23, 2026
Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
CVE-2026-86677
High · 8.8
CWE-89 Sep 23, 2026
Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
CVE-2025-9787
Medium · 6.1
CWE-79 Dec 18, 2025
Stored XSS
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
CVE-2025-9223
High · 8.8
CWE-77 Nov 11, 2025
Command Injection
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
CVE-2025-6239
Medium · 6.5
CWE-200 Oct 21, 2025
Information disclosure
Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.