7.6

CVE-2026-12370

Remote Code Execution Vulnerability

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerZohocorp
≫
Produkt ManageEngine OpManager
Default Statusunaffected
Version 0
Version < 12.8.668
Status affected
HerstellerZohocorp
≫
Produkt ManageEngine NetFlow Analyzer
Default Statusunaffected
Version 0
Version < 12.8.668
Status affected
HerstellerZohocorp
≫
Produkt ManageEngine Network Configuration Manager
Default Statusunaffected
Version 0
Version < 12.8.668
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.52% 0.734
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
0fc0942c-577d-436f-ae8e-945763c79b02 7.6 2.8 4.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

https://www.manageengine.com/itom/advisory/cve-2026-12370.html