CVE-2026-86681 – Zoho ManageEngine Applications Manager
“A private key shipped inside an installer turns your monitoring tool into a direct path to your cloud.”
This patch for ZohoCorp ManageEngine Applications Manager fixes two vulnerabilities in versions 182200 and below. CVE-2026-86708 has a CVSS score of 10.0, Critical severity. The Applications Manager installer exposes a Google Cloud service-account private key. An unauthenticated attacker can use that key to impersonate the service account and access or modify the cloud resources tied to it.
CVE-2026-86681 has a CVSS score of 7.6, High severity. A permissions validation flaw lets low-privileged users run administrator-configured MBean actions on monitors outside their assigned scope, which gives them elevated control. Together, these flaws expose both the monitoring platform and the cloud resources it connects to. Apply this update now.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-306