CVE-2026-6516

Full vulnerability record from the local CVENow database.

Description

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

Severity

CRITICAL

CVSS score

10.0 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

0fc0942c-577d-436f-ae8e-945763c79b02

Published

2026-07-23 18:17:02.570000

Last modified

2026-10-24 13:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-6516",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "published": "2026-07-23T18:17:02.570",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API."
    },
    {
      "lang": "es",
      "value": "Las versiones de Zohocorp ManageEngine ADAudit Plus anteriores a la 8606 se ven afectadas por una ejecución remota de código no autenticada debido a la API de agente vulnerable."
    }
  ],
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "ManageEngine ADAudit Plus",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "8606",
              "versionType": "8606",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T00:00:00+00:00",
          "id": "CVE-2026-6516",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ]
}