# CVE-2026-84791: Zoho ManageEngine OpManager and Firewall Analyzer access control bypass

Source: https://junglewise.ai/threats/cve-2026-84791-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84791 · Severity: high · CVSS 7.1 · Published 2026-09-23

Zoho ManageEngine OpManager and Firewall Analyzer are network and firewall management tools used by IT teams. A broken access control vulnerability allowed low-privilege users to modify Change Management report schedules for firewalls they were not authorized to access, potentially disrupting report delivery and visibility into unassigned firewall changes.

Technologies: [Zoho ManageEngine Firewall Analyzer](https://junglewise.ai/threats/technologies/manageengine-firewall-analyzer), [Zoho ManageEngine OpManager](https://junglewise.ai/threats/technologies/manageengine-opmanager), [Zoho ManageEngine OpManager Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-enterprise-edition), [Zoho ManageEngine OpManager Nexus](https://junglewise.ai/threats/technologies/manageengine-opmanager-nexus), [Zoho ManageEngine OpManager Nexus Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-nexus-enterprise-edition). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-84791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84791 being exploited in the wild.

**How severe is CVE-2026-84791?** High severity, with a CVSS score of 7.1, published 23 September 2026.

**Which products and versions are affected?** Zoho ManageEngine Firewall Analyzer 12.8.710 and below, 12.8.718 to 12.9.124, 12.9.133 to 12.9.134; Zoho ManageEngine OpManager 12.8.710 and below; Zoho ManageEngine OpManager Enterprise Edition 12.8.710 and below; Zoho ManageEngine OpManager Nexus 12.8.710 and below; and 1 more.

**Is there a fix for CVE-2026-84791?** A patch was published on 2026-08-28: Firewall Analyzer versions 12.9.135 and above patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84791 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-84791?** Check whether you run Zoho ManageEngine Firewall Analyzer, Zoho ManageEngine OpManager, Zoho ManageEngine OpManager Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control flaw in the Change Management report scheduling module failed to validate whether an authenticated user's assigned firewall scope included the target firewall before allowing modifications. An attacker with low-privilege credentials could modify or reschedule Change Management report configurations for any firewall in the system, bypassing intended access boundaries.

## Affected products

- Zoho ManageEngine OpManager 12.8.710 and below
- Zoho ManageEngine OpManager Enterprise Edition 12.8.710 and below
- Zoho ManageEngine OpManager Nexus 12.8.710 and below
- Zoho ManageEngine OpManager Nexus Enterprise Edition 12.8.710 and below
- Zoho ManageEngine Firewall Analyzer 12.8.710 and below, 12.8.718 to 12.9.124, 12.9.133 to 12.9.134

## Timeline

- 2026-09-23: disclosed: Vulnerability disclosed publicly
- 2026-08-28: patched: Firewall Analyzer versions 12.9.135 and above patched
- 2026-09-03: patched: Firewall Analyzer versions 12.9.125 and above patched
- 2026-09-01: patched: OpManager/Enterprise Edition/Nexus versions 12.8.711 and above patched

## References

- [https://www.manageengine.com/itom/advisory/cve-2026-84791.html](https://www.manageengine.com/itom/advisory/cve-2026-84791.html)

## Related threats

- [Zoho ManageEngine OpManager and Firewall Analyzer credential exposure in syslog collector](https://junglewise.ai/threats/cve-2026-76980-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer XML injection in Rule Tracking](https://junglewise.ai/threats/cve-2026-76979-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer command injection in Diagnose Settings](https://junglewise.ai/threats/cve-2026-76978-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager privilege escalation through Report Profile import](https://junglewise.ai/threats/cve-2026-84787-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [ManageEngine OpManager path traversal in Smart Update Manager](https://junglewise.ai/threats/cve-2026-15358-zohocorp-manageengine-opmanager-and-network-configuration-manager)