CVE-2026-84789: Broken Access Control vulnerability

Q: Who can exploit this issue?

An authenticated user with low-privilege access can exploit it. The issue affects their ability to create firewall alert notifications outside the scope assigned to that user.

Q: Does exploitation require user interaction or network access?

The supplied vector indicates network access, low attack complexity, low privileges required, and no user interaction. An attacker must first have an authenticated low-privilege account.

Published Sep 23, 2026

Updated

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.

Affected Software

2 affected components

Zohocorp ManageEngine OpManager<=12.8.710

Zohocorp Manageengine Firewall Analyzer<=12.8.710

Event History

Sep 23, 2026

CVE Published

via MITRE·11:51 AM

Data Sourced

via MITRE·11:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with low-privilege access can exploit it. The issue affects their ability to create firewall alert notifications outside the scope assigned to that user.

Does exploitation require user interaction or network access?

The supplied vector indicates network access, low attack complexity, low privileges required, and no user interaction. An attacker must first have an authenticated low-privilege account.

Which versions are affected?

ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected.