# CVE-2026-76979: Zoho ManageEngine OpManager and Firewall Analyzer XML injection in Rule Tracking

Source: https://junglewise.ai/threats/cve-2026-76979-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76979 · Severity: high · CVSS 7.7 · Published 2026-09-23

Zoho ManageEngine OpManager and Firewall Analyzer are network management platforms used to monitor and configure enterprise firewalls and network devices. A low-privilege attacker can upload a malicious firewall configuration file to the Compare Policies feature, exploiting insufficient XML validation to read sensitive files, trigger unauthorized outbound requests, or cause service outages.

Technologies: [Zoho ManageEngine Firewall Analyzer](https://junglewise.ai/threats/technologies/manageengine-firewall-analyzer), [Zoho ManageEngine OpManager](https://junglewise.ai/threats/technologies/manageengine-opmanager), [Zoho ManageEngine OpManager Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-enterprise-edition), [Zoho ManageEngine OpManager Nexus](https://junglewise.ai/threats/technologies/manageengine-opmanager-nexus), [Zoho ManageEngine OpManager Nexus Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-nexus-enterprise-edition). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-76979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76979 being exploited in the wild.

**How severe is CVE-2026-76979?** High severity, with a CVSS score of 7.7, published 23 September 2026.

**Which products and versions are affected?** Zoho ManageEngine Firewall Analyzer 12.8.709 and below; 12.8.718 to 12.9.122; Zoho ManageEngine OpManager 12.8.709 and below; Zoho ManageEngine OpManager Enterprise Edition 12.8.709 and below; Zoho ManageEngine OpManager Nexus 12.8.709 and below; and 1 more.

**Is there a fix for CVE-2026-76979?** A patch was published on 2026-08-14: OpManager patched with versions 12.8.710 and above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76979 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76979?** Check whether you run Zoho ManageEngine Firewall Analyzer, Zoho ManageEngine OpManager, Zoho ManageEngine OpManager Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An XML injection vulnerability exists in the Rule Tracking Compare Policies feature due to insufficient validation of uploaded firewall configuration files. A low-privilege user can exploit this to read arbitrary files on the server, trigger unauthorized outbound requests, or cause denial of service. The vulnerability affects OpManager, OpManager Enterprise Edition, OpManager Nexus variants, and Firewall Analyzer through version 12.8.709, with fixes available in 12.8.710+ and 12.9.124+ respectively.

## Affected products

- Zoho ManageEngine OpManager 12.8.709 and below
- Zoho ManageEngine OpManager Enterprise Edition 12.8.709 and below
- Zoho ManageEngine OpManager Nexus 12.8.709 and below
- Zoho ManageEngine OpManager Nexus Enterprise Edition 12.8.709 and below
- Zoho ManageEngine Firewall Analyzer 12.8.709 and below; 12.8.718 to 12.9.122

## Timeline

- 2026-09-23: disclosed: Vulnerability publicly disclosed
- 2026-08-14: patched: OpManager patched with versions 12.8.710 and above
- 2026-08-20: patched: Firewall Analyzer patched with versions 12.9.124 and above

## References

- [https://www.manageengine.com/itom/advisory/cve-2026-76979.html](https://www.manageengine.com/itom/advisory/cve-2026-76979.html)

## Related threats

- [Zoho ManageEngine OpManager and Firewall Analyzer credential exposure in syslog collector](https://junglewise.ai/threats/cve-2026-76980-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer command injection in Diagnose Settings](https://junglewise.ai/threats/cve-2026-76978-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer access control bypass](https://junglewise.ai/threats/cve-2026-84791-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager privilege escalation through Report Profile import](https://junglewise.ai/threats/cve-2026-84787-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [ManageEngine OpManager path traversal in Smart Update Manager](https://junglewise.ai/threats/cve-2026-15358-zohocorp-manageengine-opmanager-and-network-configuration-manager)