CVE-2026-18911

HighCVSS 7.5

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.06%

63th percentile - higher than 63% of all known CVEs

Summary

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the system, potentially leading to data integrity compromise or data leakage.

Recommendation

It is recommended to upgrade to version 6310 or later immediately to remediate the vulnerability.

Other vulnerabilities in ManageEngine DataSecurity Plus

CVE-2026-18912High
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability. An authenticated technician can execute arbitrary SQL queries through the Reports module.

Original NVD description (English source)

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS