Quick answers
- Is CVE-2026-86677 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86677 being exploited in the wild.
- How severe is CVE-2026-86677?
- High severity, with a CVSS score of 8.8, published 23 September 2026.
- Which products and versions are affected?
- Zoho ManageEngine Applications Manager 182000 and below.
- Is there a fix for CVE-2026-86677?
- A patch was published on 2026-08-26: Fixed in version 182100 and above, and versions 181104-181109, 182001-182009 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86677 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-86677?
- Check whether you run Zoho ManageEngine Applications Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authorization weakness in the enterprise synchronization endpoint permitted low-privileged authenticated users to register unauthorized managed servers. Insufficiently protected synchronization responses could then execute attacker-controlled SQL statements on the Central server database. This network-based attack requires valid credentials but no additional user interaction; successful exploitation grants Enterprise Administrator privileges and arbitrary code execution with service-level privileges.
Affected products
- Zoho ManageEngine Applications Manager 182000 and below
Timeline
- 2026-09-23: disclosed
- 2026-08-26: patched: Fixed in version 182100 and above, and versions 181104-181109, 182001-182009