# CVE-2026-86678: Zoho ManageEngine Applications Manager API key disclosure

Source: https://junglewise.ai/threats/cve-2026-86678-zohocorp-manageengine-applications-manager-versions-182000-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86678 · Severity: high · CVSS 8.8 · Published 2026-09-23

Zoho ManageEngine Applications Manager is a monitoring and performance management tool used by enterprises to track IT infrastructure. A permissions flaw in the plugin allowed low-privileged users to retrieve administrator API keys, enabling attackers to escalate privileges and gain full control of the monitoring system and access sensitive operational data.

Technologies: [Zoho ManageEngine Applications Manager](https://junglewise.ai/threats/technologies/manageengine-applications-manager). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-86678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86678 being exploited in the wild.

**How severe is CVE-2026-86678?** High severity, with a CVSS score of 8.8, published 23 September 2026.

**Which products and versions are affected?** Zoho ManageEngine Applications Manager 182000 and below.

**Is there a fix for CVE-2026-86678?** A patch was published on 2026-08-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86678 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86678?** Check whether you run Zoho ManageEngine Applications Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A permissions issue in the Applications Manager plugin's profile endpoint allowed authenticated low-privileged users to request another user's profile and retrieve their API key without proper authorization checks. An attacker with a low-privileged account could exploit this to obtain an administrator's API key and use it to perform administrative operations, potentially compromising the entire monitoring infrastructure. The fix enforces token-based authentication on the affected endpoint.

## Affected products

- Zoho ManageEngine Applications Manager 182000 and below

## Timeline

- 2026-09-23: disclosed
- 2026-08-26: patched

## References

- [https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html](https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html)

## Related threats

- [Zoho ManageEngine Applications Manager privilege escalation in proxy settings](https://junglewise.ai/threats/cve-2026-86683-zohocorp-manageengine-applications-manager-versions-182000-and)
- [Zoho ManageEngine Applications Manager permission bypass in service monitor deletion](https://junglewise.ai/threats/cve-2026-86679-zohocorp-manageengine-applications-manager-versions-182000-and)
- [Zoho ManageEngine Applications Manager privilege escalation in synchronization](https://junglewise.ai/threats/cve-2026-86677-zohocorp-manageengine-applications-manager-versions-182000-and)