CVE-2026-86679

Unauthorized deletion of monitored services outside a low-privileged user’s assigned scope.

Vulnerability Details
Severity	High
CVE ID	CVE-2026-86679
Affected software versions	Version 182000 and below
Fixed Version	Version 182100 and above Version 181104 to 181109 Version 182001 to 182009
Fixed On	26 August 2026

Details

A permissions validation issue in Applications Manager allowed a low-privileged user to delete a service monitor outside the user’s assigned scope.

Impact

An authenticated operator or delegated administrator could delete service monitors they were not authorized to manage, disrupting monitoring coverage, preventing future alerts, and potentially removing related service history and records.

Fix

Applications Manager version 182100 (refer above for other fixed versions) and above fixes this issue by enforcing proper validation of Service IDs.

Steps to update

Update your Applications Manager instance to the latest build using the service pack.

Source and Acknowledgements

Find out more about CVE-2026-86679 from CVE Directory and NIST NVD

Reported by:

sealldev

Need Help?

For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com

Loved by customers all over the world

"Standout Tool With Extensive Monitoring Capabilities"

★★★★★

It allows us to track crucial metrics such as response times, resource utilization, error rates, and transaction performance. The real-time monitoring alerts promptly notify us of any issues or anomalies, enabling us to take immediate action.

Reviewer Role: Research and Development

"I like Applications Manager because it helps us to detect issues present in our servers and SQL databases."

Carlos Rivero

Tech Support Manager, Lexmark

Trusted by thousands of leading businesses globally