# CVE-2026-86683: Zoho ManageEngine Applications Manager privilege escalation in proxy settings

Source: https://junglewise.ai/threats/cve-2026-86683-zohocorp-manageengine-applications-manager-versions-182000-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86683 · Severity: high · CVSS 8.1 · Published 2026-09-23

Zoho ManageEngine Applications Manager is a network and application monitoring platform used by enterprises to track system performance and health. A flaw in permission validation allowed low-privileged read-only users to modify global proxy settings that should only be accessible to administrators. An attacker with read-only credentials could redirect the monitoring tool's outbound traffic through an attacker-controlled proxy, potentially intercepting sensitive credentials and manipulating monitoring data to hide security issues.

Technologies: [Zoho ManageEngine Applications Manager](https://junglewise.ai/threats/technologies/manageengine-applications-manager). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-86683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86683 being exploited in the wild.

**How severe is CVE-2026-86683?** High severity, with a CVSS score of 8.1, published 23 September 2026.

**Which products and versions are affected?** Zoho ManageEngine Applications Manager 182000 and below.

**Is there a fix for CVE-2026-86683?** A patch was published on 2026-08-26: Fixed in versions 182100 and above, 181104-181109, 182001-182009 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86683 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86683?** Check whether you run Zoho ManageEngine Applications Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A permissions validation issue in the proxy synchronization endpoint failed to enforce role-based access control, allowing authenticated read-only users to invoke administrative proxy configuration changes. The vulnerability requires valid user credentials but does not require network access beyond the authenticated interface. Exploitation allows modification of proxy settings to intercept and manipulate outbound HTTP monitoring traffic, exposing credentials and enabling data tampering.

## Affected products

- Zoho ManageEngine Applications Manager 182000 and below

## Timeline

- 2026-09-23: disclosed
- 2026-08-26: patched: Fixed in versions 182100 and above, 181104-181109, 182001-182009

## References

- [https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86683.html](https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86683.html)

## Related threats

- [Zoho ManageEngine Applications Manager permission bypass in service monitor deletion](https://junglewise.ai/threats/cve-2026-86679-zohocorp-manageengine-applications-manager-versions-182000-and)
- [Zoho ManageEngine Applications Manager API key disclosure](https://junglewise.ai/threats/cve-2026-86678-zohocorp-manageengine-applications-manager-versions-182000-and)
- [Zoho ManageEngine Applications Manager privilege escalation in synchronization](https://junglewise.ai/threats/cve-2026-86677-zohocorp-manageengine-applications-manager-versions-182000-and)