CVE-2026-76978 – Zoho ManageEngine OpManager
“When the tool that watches your whole network can be turned against it, every unpatched hour gives an attacker the map and the keys.”
This ManageEngine OpManager update fixes six vulnerabilities. One is Critical and five are High. The most severe, CVE-2026-19599, has a CVSS score of 9.9, Critical severity. It is a remote code execution flaw in the Notification Profile module of OpManager MSP. Two more flaws also lead to code execution. CVE-2026-76978 has a CVSS score of 8.8, High severity, and is a command injection flaw in the Diagnose Settings feature. CVE-2026-12370 has a CVSS score of 7.6, High severity, and is a server-side template injection flaw in Configlet processing.
The other three flaws give attackers more access than they should have. CVE-2026-75825 has a CVSS score of 8.8, High severity. It is an authentication bypass when the Application Manager Plugin is enabled. CVE-2026-84787 has a CVSS score of 8.1, High severity. It lets an authenticated low-privilege user gain Administrator rights through Report Profile import. CVE-2026-15358 has a CVSS score of 7.5, High severity, and is an unauthorized path traversal flaw. Some of these flaws also affect NetFlow Analyzer, Network Configuration Manager and Firewall Analyzer. Because OpManager has broad access to the network, an attacker who takes control of it gains a strong position to attack everything it manages.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-78