# CVE-2026-86681

### Unauthorized execution of administrator-configured MBean actions outside a low-privileged user’s assigned scope.

| Vulnerability Details |  |
|---|---|
| Severity | **High** |
| CVE ID | CVE-2026-86681 |
| Affected software versions | Version 182200 and below |
| Fixed Version | Version 182300 and above<br>Version 181104 to 181109<br>Version 182001 to 182009 |
| Fixed On | 08 September 2026 |

## Details

A permissions validation issue in Applications Manager allowed a low-privileged user to execute an administrator-configured MBean action against a monitor outside the user’s assigned monitor groups.

## Impact

An authenticated operator or delegated administrator could perform unauthorized management operations on monitored systems, potentially causing service disruption, deployment changes, or other unintended runtime changes depending on the configured MBean actions.

## Fix

Applications Manager version 182300 (refer above for other fixed versions) and above fixes this issue by properly validating that the requested action is authorized and that its target monitor is within the low-privileged user’s assigned scope.

## Steps to update

Update your Applications Manager instance to the latest build using the service pack.

## Source and Acknowledgements

Find out more about CVE-2026-86681 from [CVE Directory](https://www.cve.org/CVERecord?id=CVE-2026-86681) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-86681).

## Reported by:

sealldev

### Need Help?

For clarification or corrections please contact our [support team](https://www.manageengine.com/products/applications_manager/support.html) or email us at [appmanager-support@manageengine.com](mailto:appmanager-support@manageengine.com).