Description
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
Published: 2026-07-23
Score: 10 Critical
EPSS: 4.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unprotected agent API calls in ManageEngine ADAudit Plus allow unauthenticated users to inject and execute arbitrary OS commands. The flaw is an instance of command injection, giving attackers full control over the affected host and potentially compromising confidentiality, integrity, and availability of the system.

Affected Systems

Zohocorp’s ManageEngine ADAudit Plus, versions prior to 8606. The vulnerability affects the agent API exposed by these versions.

Risk and Exploitability

The CVSS score of 10 indicates critical severity, and the EPSS score of 5% suggests a moderate probability of real‑world exploitation. The flaw is not yet listed in CISA’s KEV catalog, but the lack of authentication and remote access via the API make it a high‑risk target for attackers.

Generated by OpenCVE AI on August 3, 2026 at 21:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ManageEngine ADAudit Plus to version 8606 or newer to remove the vulnerable agent API.
  • If an upgrade cannot be performed immediately, restrict or block external access to the agent API endpoint, limiting it to trusted internal networks or IP ranges.
  • Continuously monitor audit logs for suspicious command execution attempts and apply additional network segmentation or firewall rules as a temporary containment measure.

Generated by OpenCVE AI on August 3, 2026 at 21:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
Title Remote Code Execution
First Time appeared Zohocorp
Zohocorp manageengine Adaudit Plus
Weaknesses CWE-78
CPEs cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*
Vendors & Products Zohocorp
Zohocorp manageengine Adaudit Plus
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Zohocorp Manageengine Adaudit Plus
cve-icon MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published:

Updated: 2026-07-24T03:56:26.762Z

Reserved: 2026-04-17T13:48:22.236Z

Link: CVE-2026-6516

cve-icon Vulnrichment

Updated: 2026-07-23T19:04:27.736Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-23T18:17:02.570

Modified: 2026-07-24T05:16:50.033

Link: CVE-2026-6516

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T21:15:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')