# CVE-2026-86677

### Privilege escalation in Applications Manager Enterprise Edition may allow remote code execution through the Enterprise synchronization channel.

| Vulnerability Details |  |
|---|---|
| Severity | **High** |
| CVE ID | CVE-2026-86677 |
| Affected software versions | Version 182000 and below |
| Fixed Version | Version 182100 and above<br>Version 181104 to 181109<br>Version 182001 to 182009 |
| Fixed On | 26 August 2026 |

## Details

An authorization weakness allowed a low-privileged authenticated user to register an unauthorized managed server, after which insufficiently protected synchronization responses could cause the Central server to execute attacker-controlled SQL statements.

## Impact

Successful exploitation could allow an attacker to modify the Central server database, gain Enterprise Administrator privileges, execute arbitrary code with service privileges, and potentially compromise connected Probe servers.

## Fix

Applications Manager version 182100 (refer above for other fixed versions) and above fixes the vulnerability in the affected communication endpoint by enforcing token-based authentication.

## Steps to update

Update your Applications Manager instance to the latest build using the service pack.

## Source and Acknowledgements

Find out more about CVE-2026-86677 from [CVE Directory](https://www.cve.org/CVERecord?id=CVE-2026-86677) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-86677).

## Reported by:

Whoami

### Need Help?

For clarification or corrections please contact our [support team](https://www.manageengine.com/products/applications_manager/support.html) or email us at [appmanager-support@manageengine.com](mailto:appmanager-support@manageengine.com).