CVE-2025-9787
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. The vulnerability could allow an attacker to inject malicious script that executes in the victim's browser.
Risk Assessment
An attacker can execute malicious scripts in the context of the user's browser, potentially leading to session theft or other actions on behalf of the victim.
Recommendation
Update ManageEngine Applications Manager to a version later than 177400 that includes the fix for this vulnerability.
Other vulnerabilities in ManageEngine Applications Manager
See all- CVE-2026-86708Critical
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
- CVE-2026-86683High
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
- CVE-2026-86681High
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
- CVE-2026-86679High
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
- CVE-2026-86678High
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- CVE-2026-86677High
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
- CVE-2025-6239Medium
Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.
Original NVD description (English source)
Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS