CVE-2026-76978: Command Injection vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer versions 12.8.709 and below are affected. The vulnerable functionality is the Diagnose Settings feature.
What level of access does an attacker need?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. The provided data does not identify which specific low-privilege role or account permissions are sufficient.
What could successful exploitation allow?
The listed impact is high for confidentiality, integrity, and availability. This indicates an attacker who exploits the issue could potentially compromise data confidentiality, alter data or system state, and disrupt service availability.