# Privilege Escalation vulnerability- CVE-2026-84787

**Severity:** High

**CVE ID:** CVE-2026-84787

| Product name | Affected Version(s) | Fixed Version(s) | Fixed On |
|---|---|---|---|
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.8.710 and below | [12.8.711 and above*](https://www.manageengine.com/network-monitoring/service-packs.html) | 01-09-2026 |
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.8.718 to 12.9.124 | [12.9.125 and above*](https://www.manageengine.com/network-monitoring/itom-servicepack.html?service-pack=opm) | 03-09-2026 |
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.9.133 to 12.9.134 | 12.9.135 and above | 28-08-2026 |

**Note:** This security vulnerability is applicable only for users of Firewall Analyzer, and for OpManager/Enterprise Edition/Nexus users with the Firewall Analyzer Plugin enabled.

## Details

A privilege escalation vulnerability allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import. This issue has now been fixed.

## Impact

A low-privilege user could import a Report Profile containing unauthorized privilege settings and obtain Administrator-level access. This could allow the user to perform actions beyond their intended permissions.

## Fix

The Report Profile import operation now validates and restricts imported privilege settings based on the importing user's authorized role. Operator users can no longer gain Administrator privileges through Report Profile import.

## Steps to upgrade

1. Download the latest upgrade pack from [here](https://www.manageengine.com/network-monitoring/service-packs.html).
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above step.

## Source and Acknowledgements

This vulnerability was reported by **zeocrynt**.

Kindly contact our product support teams for further details, at the email address mentioned below:

- OpManager: [opmanager-support@manageengine.com](mailto:opmanager-support@manageengine.com)