CVE-2026-86683 PUBLISHED

Broken Authentication Vulnerability

Assigner: Zohocorp
Reserved: 08.09.2026 Published: 23.09.2026 Updated: 23.09.2026

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 8.1

Product Status

Vendor Zohocorp
Product ManageEngine Applications Manager
Versions Default: unaffected
  • affected from 0 to 182100 (excl.)

References

Problem Types

  • CWE-20 Improper input validation CWE

Impacts

  • CAPEC-122 Privilege Abuse