CVE-2026-86681

Unauthorized execution of administrator-configured MBean actions outside a low-privileged user’s assigned scope.

Details

A permissions validation issue in Applications Manager allowed a low-privileged user to execute an administrator-configured MBean action against a monitor outside the user’s assigned monitor groups.

Impact

An authenticated operator or delegated administrator could perform unauthorized management operations on monitored systems, potentially causing service disruption, deployment changes, or other unintended runtime changes depending on the configured MBean actions.

Fix

Applications Manager version 182300 (refer above for other fixed versions) and above fixes this issue by properly validating that the requested action is authorized and that its target monitor is within the low-privileged user’s assigned scope.

Steps to update

Update your Applications Manager instance to the latest build using the service pack.

Source and Acknowledgements

Find out more about CVE-2026-86681 from CVE Directory and NIST NVD

Reported by:

sealldev

Need Help?

For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com