Critical Privilege Escalation and Remote Code Execution Vulnerabilities Disclosed in ManageEngine Products Including M365 Manager Plus

Entenda a falha

A vulnerabilidade

Zoho disclosed eight ManageEngine flaws on November 12, 2026. The worst is CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus: a technician account can abuse weak permission checks in the delegated administration interface to escalate privileges, and possibly reach remote code execution during administrative processing. CVE-2026-12507 (9.1) in the ServiceDesk Plus Reports module lets a user with the Create Query Reports permission run arbitrary commands on the server through crafted queries. CVE-2026-19422 (9.1) in DDI Central is unauthenticated: it lets an attacker impersonate onboarded Windows servers through the DNS/DHCP agent sync APIs and change DNS and DHCP settings. CVE-2026-19421 and CVE-2026-75869 allow PowerShell injection through crafted TXT records or DNS suffix values, leading to commands on managed Windows servers. Fixed in M365 Manager Plus build 4818, ServiceDesk Plus 15290, and ServiceDesk Plus MSP and SupportCenter Plus 15150. The articles give no fixed build for DDI Central.

Como funciona

In M365 Manager Plus, a logged-in technician sends requests to the delegated administration interface, which is meant to limit what each role can do. Because the permission checks are weak, the request is accepted beyond the technician's intended scope, and the elevated action can end in code execution while the product processes administrative tasks. In ServiceDesk Plus, a user with the Create Query Reports permission submits database queries to the Reports module, which handles them in a way that ends in commands running on the underlying server. In DDI Central, the sync APIs used by Windows DNS and DHCP agents accept calls without proving who is calling, so a caller can pose as an onboarded server and push configuration changes. The PowerShell issues occur when TXT record or DNS suffix values are passed into PowerShell on managed servers.

Por que é vulnerável

The common thread is missing or weak validation. In M365 Manager Plus and the DDI Central non-admin flaws, authorization checks do not properly enforce the role boundaries. In DDI Central's sync APIs, the caller's identity is not authenticated. In the PowerShell cases, input from TXT records and DNS suffix fields is not safely handled before it reaches a command interpreter (injection). In ServiceDesk Plus, crafted queries are not restricted enough to prevent command execution. The articles do not describe why these went unnoticed or the details of each code fix; the fix is delivered as updated builds.

Onde está

The articles name only components: the delegated administration interface in M365 Manager Plus, the Reports module in ServiceDesk Plus, and the Windows DNS/DHCP agent sync APIs in DDI Central; no files, functions or commits are given.

Como foi descoberta

The articles do not say who found the flaws or how. Zoho published the eight CVEs and the advisories on November 12, 2026. Zoho reports no exploitation, and none of the flaws is listed in CISA's KEV catalog.

Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 23:15.