CVE-2026-84791: Broken Access Control vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege user can exploit it. The affected capability is modifying Change Management report schedule configurations for firewalls outside that user's assigned scope.
Are systems affected by default?
The issue applies to ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below. Exploitation requires an authenticated low-privilege account and the presence of Change Management report schedule configurations for firewalls.
How can I determine whether my environment is exposed?
Check whether you run ZohoCorp ManageEngine OpManager or Firewall Analyzer version 12.8.710 or below. Review whether low-privilege users can modify Change Management report schedules associated with firewalls outside their assigned scope.