Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation…
Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Zohocorp
- Product
- M365 Manager Plus
- CVSS v3.1
- 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness
- CWE-862
- Exposure class
- Identity
- NVD status
- Received
Why it ranks 45 (High)
- CVSS v3.1 9.9 critical
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-12591 on this site · NVD · CVE.org · Vulnpedia