Is CVE-2026-75825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75825 being exploited in the wild.

How severe is CVE-2026-75825?

High severity, with a CVSS score of 8.8, published 23 September 2026.

Which products and versions are affected?

ManageEngine OpManager 12.8.510 to 12.8.710 (with Application Manager Plugin enabled); ManageEngine OpManager Enterprise Edition 12.8.718 to 12.9.122 (with Application Manager Plugin enabled); ManageEngine OpManager Nexus 12.9.133 (with Application Manager Plugin enabled); ManageEngine OpManager Nexus Enterprise Edition 12.8.510 to 12.8.710 (with Application Manager Plugin enabled).

Is there a fix for CVE-2026-75825?

A patch was published on 2026-08-20: OpManager Nexus 12.9.134 fixed version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75825 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75825?

Check whether you run ManageEngine OpManager, ManageEngine OpManager Enterprise Edition, ManageEngine OpManager Nexus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75825: ManageEngine OpManager authentication bypass in Application Manager Plugin

CVE-2026-75825 · Severity: high · CVSS 8.8 · Published 2026-09-23

ManageEngine OpManager is a network and IT operations monitoring platform. When the Application Manager Plugin is enabled, a logged-in user with access to the Applications module can bypass authentication to access the plugin as a different user, including administrators, without knowing their password. An attacker with valid OpManager credentials could gain elevated privileges and full administrative control over the monitoring system.

Vendors: ManageEngine.

Quick answers

Is CVE-2026-75825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75825 being exploited in the wild.
How severe is CVE-2026-75825?: High severity, with a CVSS score of 8.8, published 23 September 2026.
Which products and versions are affected?: ManageEngine OpManager 12.8.510 to 12.8.710 (with Application Manager Plugin enabled); ManageEngine OpManager Enterprise Edition 12.8.718 to 12.9.122 (with Application Manager Plugin enabled); ManageEngine OpManager Nexus 12.9.133 (with Application Manager Plugin enabled); ManageEngine OpManager Nexus Enterprise Edition 12.8.510 to 12.8.710 (with Application Manager Plugin enabled).
Is there a fix for CVE-2026-75825?: A patch was published on 2026-08-20: OpManager Nexus 12.9.134 fixed version released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75825 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75825?: Check whether you run ManageEngine OpManager, ManageEngine OpManager Enterprise Edition, ManageEngine OpManager Nexus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the OpManager Application Manager Plugin (APM) login flow when the APM module is enabled. A logged-in user can craft requests that are not properly verified against the identity of the authenticated user, allowing them to escalate privileges to other accounts. The fix strengthens SSO login validation to verify that login requests match the identity of the user who initiated them.

Affected products

ManageEngine OpManager 12.8.510 to 12.8.710 (with Application Manager Plugin enabled)
ManageEngine OpManager Enterprise Edition 12.8.718 to 12.9.122 (with Application Manager Plugin enabled)
ManageEngine OpManager Nexus 12.9.133 (with Application Manager Plugin enabled)
ManageEngine OpManager Nexus Enterprise Edition 12.8.510 to 12.8.710 (with Application Manager Plugin enabled)

Timeline

2026-09-23: disclosed: Vulnerability publicly disclosed
2026-08-20: patched: OpManager Nexus 12.9.134 fixed version released
2026-08-21: patched: OpManager Enterprise Edition 12.9.124 fixed version released
2026-09-01: patched: OpManager 12.8.711 and above fixed version released

References

https://www.manageengine.com/itom/advisory/cve-2026-75825.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.