CVE-2026-12370
HighCVSS 7.6Summary
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below are vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise and data breach.
Recommendation
Immediately update to the latest available version of ManageEngine products that includes a fix for this vulnerability.
Other vulnerabilities in ManageEngine
See all- CVE-2022-47966CriticalActively exploited
Remote code execution vulnerability in multiple Zoho ManageEngine on-premise products due to Apache Santuario xmlsec 1.4.1, where XSLT features are not properly secured. Exploitation only possible if SAML SSO has been configured.
- CVE-2026-2740High
Authenticated remote code execution vulnerability in Zohocorp ManageEngine products: ADSelfService Plus before 6525, DataSecurity Plus before 6264, and RecoveryManager Plus before 6313. Caused by a bug in a third-party dependency.
Original NVD description (English source)
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.