Executive brief
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
Junglewise Threat Intelligence
CVE-2026-86678: ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and
CVE-2026-86678 · Severity: high · CVSS 8.8 · Published 2026-09-23