Is CVE-2026-84789 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84789 being exploited in the wild.

How severe is CVE-2026-84789?

High severity, with a CVSS score of 7.1, published 23 September 2026.

Which products and versions are affected?

Zohocorp ManageEngine Firewall Analyzer 12.8.710 and below; 12.8.718 to 12.9.124; 12.9.133 to 12.9.134; Zohocorp ManageEngine OpManager 12.8.710 and below; Zohocorp ManageEngine OpManager Enterprise Edition 12.8.710 and below; Zohocorp ManageEngine OpManager Nexus 12.8.710 and below; and 1 more.

Is there a fix for CVE-2026-84789?

A patch was published on 2026-08-28: Fixed in Firewall Analyzer 12.9.135 and above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84789 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-84789?

Check whether you run Zohocorp ManageEngine Firewall Analyzer, Zohocorp ManageEngine OpManager, Zohocorp ManageEngine OpManager Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84789: ZohoCorp ManageEngine OpManager and Firewall Analyzer access control bypass

CVE-2026-84789 · Severity: high · CVSS 7.1 · Published 2026-09-23

ManageEngine OpManager and Firewall Analyzer are network monitoring and firewall management tools used by enterprises to oversee their IT infrastructure. A broken access control vulnerability allowed low-privilege authenticated users to create alert notifications for firewalls outside their assigned scope, potentially enabling unauthorized alert delivery and scope violations. The vulnerability affects versions 12.8.710 and below across both products and has been patched.

Vendors: Zohocorp.

Quick answers

Is CVE-2026-84789 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84789 being exploited in the wild.
How severe is CVE-2026-84789?: High severity, with a CVSS score of 7.1, published 23 September 2026.
Which products and versions are affected?: Zohocorp ManageEngine Firewall Analyzer 12.8.710 and below; 12.8.718 to 12.9.124; 12.9.133 to 12.9.134; Zohocorp ManageEngine OpManager 12.8.710 and below; Zohocorp ManageEngine OpManager Enterprise Edition 12.8.710 and below; Zohocorp ManageEngine OpManager Nexus 12.8.710 and below; and 1 more.
Is there a fix for CVE-2026-84789?: A patch was published on 2026-08-28: Fixed in Firewall Analyzer 12.9.135 and above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84789 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-84789?: Check whether you run Zohocorp ManageEngine Firewall Analyzer, Zohocorp ManageEngine OpManager, Zohocorp ManageEngine OpManager Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability in OpManager and Firewall Analyzer failed to validate a low-privilege user's firewall scope when creating alert notifications, permitting access to unassigned resources. The flaw requires prior authentication but allows privilege escalation through scope bypass. The fix validates the user's assigned firewall scope before allowing alert-notification creation operations.

Affected products

ZohoCorp ManageEngine OpManager 12.8.710 and below
ZohoCorp ManageEngine OpManager Enterprise Edition 12.8.710 and below
ZohoCorp ManageEngine OpManager Nexus 12.8.710 and below
ZohoCorp ManageEngine OpManager Nexus Enterprise Edition 12.8.710 and below
ZohoCorp ManageEngine Firewall Analyzer 12.8.710 and below; 12.8.718 to 12.9.124; 12.9.133 to 12.9.134

Timeline

2026-09-23: disclosed: Vulnerability published
2026-08-28: patched: Fixed in Firewall Analyzer 12.9.135 and above
2026-09-03: patched: Fixed in Firewall Analyzer 12.9.125 and above
2026-09-01: patched: Fixed in OpManager variants 12.8.711 and above

References

https://www.manageengine.com/itom/advisory/cve-2026-84789.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.