CVE-2026-12591: Privilege Escalation
Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zohocorp ManageEngine M365 Manager Plusto a version that resolves this vulnerability.Fixed in 4818
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Technician accounts that can authenticate to the delegated administration interface are the relevant exposure point. The flaw allows a technician to obtain privileges beyond their intended scope.
Does exploiting this issue require prior access?
Yes. Exploitation requires authentication as a technician, but it does not require user interaction and can be performed remotely.
What could a successful attacker achieve?
A successful attacker could escalate privileges through insufficient permission validation and potentially achieve remote code execution during administrative processing.
Which versions need remediation?
ManageEngine M365 Manager Plus versions below 4818 are affected.