CVE-2026-86683

Unauthorized modification of global proxy settings by a low-privileged user.

Details

A permissions validation issue in Applications Manager’s proxy synchronization endpoint allowed an authenticated read-only user to change the product’s proxy configuration, even though proxy administration is restricted to administrators.

Impact

An attacker could redirect Applications Manager’s outbound monitoring traffic through an attacker-controlled proxy. This could expose credentials sent by monitored HTTP services and allow monitoring responses to be manipulated, potentially affecting monitoring accuracy and system security.

Fix

Applications Manager version 182100 (refer above for other fixed versions) and above fixes this issue by enforcing proper authentication for the proxy synchronization endpoint.

Steps to update

Update your Applications Manager instance to the latest build using the service pack.

Source and Acknowledgements

Find out more about CVE-2026-86683 from CVE Directory and NIST NVD

Reported by:

sealldev

Need Help?

For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com