CVE-2026-86677

Privilege escalation in Applications Manager Enterprise Edition may allow remote code execution through the Enterprise synchronization channel.

Details

An authorization weakness allowed a low-privileged authenticated user to register an unauthorized managed server, after which insufficiently protected synchronization responses could cause the Central server to execute attacker-controlled SQL statements.

Impact

Successful exploitation could allow an attacker to modify the Central server database, gain Enterprise Administrator privileges, execute arbitrary code with service privileges, and potentially compromise connected Probe servers.

Fix

Applications Manager version 182100 (refer above for other fixed versions) and above fixes the vulnerability in the affected communication endpoint by enforcing token-based authentication.

Steps to update

Update your Applications Manager instance to the latest build using the service pack.

Source and Acknowledgements

Find out more about CVE-2026-86677 from CVE Directory and NIST NVD

Reported by:

Whoami

Need Help?

For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com