Loading story…
ManageEngine has patched a critical unauthenticated remote code execution flaw in ADAudit Plus tracked as CVE-2026-6516, affecting all builds earlier than 8606. The vulnerability resides in the product's Agent API and stems from a chain involving an authentication bypass and a path traversal issue, enabling attackers to execute code remotely without credentials. The issue is classified under CWE-78, and public reporting lists a severe network-exploitable attack path with high confidentiality and integrity impact.
Zoho/ManageEngine assigned the flaw a CVSS 10.0 score and released a fix in build 8606, advising customers to update the ADAudit Plus server as well as affected Windows and Mac agents. The vendor said there was no confirmed exploitation in the wild and no public proof-of-concept at the time of disclosure. The vulnerability was reported by Linhlt of VCB.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-6516 was publicly listed as a vulnerability affecting ManageEngine ADAudit Plus versions before 8606, with unauthenticated remote code execution impact and CWE-78 mapping. The listing also referenced the vendor advisory for the issue.
Zoho/ManageEngine fixed CVE-2026-6516 in ADAudit Plus build 8606 on 17 April 2026. The vulnerability affects earlier builds and can enable unauthenticated remote code execution via Agent API weaknesses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026
Ivanti disclosed and patched multiple vulnerabilities in **Endpoint Manager (EPM)**, led by **`CVE-2024-29847`**, a critical unauthenticated remote code execution flaw in the **Agent Portal** service affecting versions prior to **EPM 2022 SU6** and the **2024 September update**. Ivanti rated the deserialization bug **CVSS 10.0** and said it could let remote attackers execute code without authentication; the September advisory also listed additional weaknesses including **XXE**, multiple **SQL injection** flaws that could lead to RCE, authentication issues in **Network Isolation** and **Patch Management**, API secret exposure, spoofing of isolation status, and a local privilege escalation bug in the EPM agent. Technical analysis of `CVE-2024-29847` said the vulnerable `Agentportal.exe` service exposed a **.NET Remoting** TCP endpoint with a dynamically assigned port and no transport security, allowing insecure deserialization against the `LANDesk.AgentPortal.IAgentPortal` interface. The researcher reported that exploitation remained possible even with the .NET Remoting type filter set to **Low**, adapting prior techniques to bypass remoting restrictions, gain code execution, and write an **ASP.NET web shell** into a public IIS application directory; the writeup further claimed the compromise could be escalated from the IIS application pool context to **`NT AUTHORITY\SYSTEM`** by abusing leaked token handles in the worker process.
Aug 1, 2026
A critical unauthenticated SQL injection vulnerability, tracked as CVE-2025-8324 with a CVSS score of 9.8, has been identified in Zoho Analytics Plus (also known as Zohocorp ManageEngine Analytics Plus) versions 6170 and below. This flaw arises from improper filter configuration, allowing remote attackers to exploit the vulnerability without authentication, potentially leading to full data takeover and exposure of sensitive information. Security advisories emphasize the severity of this issue, highlighting the risk of unauthorized access and manipulation of analytics data. Organizations using affected versions are urged to apply available patches or mitigations immediately to prevent exploitation, as the vulnerability is remotely exploitable and could be leveraged in targeted attacks against enterprise environments relying on Zoho Analytics Plus for business intelligence and reporting.
Jun 29, 2026