cve-2026-84787

HIGH CVSS 8.1 fkie_nvd
Description

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Affected Products

No product information available.

Weaknesses (CWE)
CWE-250
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 2.8 5.2 0fc0942c-577d-436f-ae8e-945763c79b02
NVD metadata
NVD status
Awaiting Analysis
Source identifier
0fc0942c-577d-436f-ae8e-945763c79b02
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "ManageEngine OpManager",
          "vendor": "Zohocorp",
          "versions": [
            {
              "lessThan": "12.8.711",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ManageEngine Firewall Analyzer",
          "vendor": "Zohocorp",
          "versions": [
            {
              "lessThan": "12.8.711",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import."
    }
  ],
  "id": "CVE-2026-84787",
  "lastModified": "2026-09-23T18:17:31.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84787",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-23T12:41:53.637319Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T12:17:07.857",
  "references": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "url": "https://www.manageengine.com/itom/advisory/cve-2026-84787.html"
    }
  ],
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary"
    }
  ]
}
View JSON API Download JSON