# Broken Access Control vulnerability- CVE-2026-84789

**Severity:** High

**CVE ID:** CVE-2026-84789

| Product name | Affected Version(s) | Fixed Version(s) | Fixed On |
|---|---|---|---|
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.8.710 and below | [12.8.711 and above*](https://www.manageengine.com/network-monitoring/service-packs.html) | 01-09-2026 |
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.8.718 to 12.9.124 | [12.9.125 and above*](https://www.manageengine.com/network-monitoring/itom-servicepack.html?service-pack=opm) | 03-09-2026 |
| OpManager<br>OpManager Enterprise Edition<br>OpManager Nexus<br>OpManager Nexus Enterprise Edition<br>Firewall Analyzer | 12.9.133 to 12.9.134 | 12.9.135 and above | 28-08-2026 |

**Note:** This security vulnerability is applicable only for users of Firewall Analyzer, and for OpManager/Enterprise Edition/Nexus users with the Firewall Analyzer Plugin enabled.

**Details:**

A broken access control vulnerability allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope. This issue has now been fixed.

**Impact:**

An low-privilege user could create alert notifications for unassigned firewalls, which could result in unauthorized alert delivery.

**Fix:**

The alert-notification creation operation now validates the user's assigned firewall scope. Users can create alert notifications only for firewalls within their authorized scope.

**Steps to upgrade:**

1. Download the latest upgrade pack from [here](https://www.manageengine.com/network-monitoring/service-packs.html).
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above step.

**Source and Acknowledgements**

This vulnerability was reported by **sealldev**.

Kindly contact our product support teams for further details, at the email address mentioned below:

- OpManager: [opmanager-support@manageengine.com](mailto:opmanager-support@manageengine.com)