ManageEngine Applications Manager Updates Address Six Vulnerabilities
Tech GuruQuick Answer
ManageEngine Applications Manager has six fixes covering different trust boundaries. Four list 182100 as the main-track fix; the MBean action-scope and installer-key issues require 182300. The vendor also lists older fixed-build exceptions, so do not treat the affected range as a simple uninterrupted number sequence. The installer issue involves a private key in a public download and does not require an attacker to sign in to your Applications Manager server.
Confirm Scope And Apply The Supported Fix
What to do now: inventory Enterprise Central/managed servers, Applications Manager Plugin instances, operator permissions, MBean actions, proxy settings and installed builds. Apply the supported track-specific update, review unexpected changes and follow the incident process for potentially exposed API keys or monitoring credentials. Ask ManageEngine to confirm disposition of the installer's exposed cloud key.
Source recheck: October 2, 2026 UTC, against all six vendor advisory pages. Their fixed-build exceptions are retained; the old cloud-key revocation question remains explicit rather than inferred from the package update.
Scope And Authority
| Product scope | ManageEngine Applications Manager builds before 182100 for four advisories and before 182300 for CVE-2026-86681 and CVE-2026-86708, subject to the branch-specific fixed builds on each advisory |
|---|---|
| Advisory | CVE-2026-86677 / CVE-2026-86678 / CVE-2026-86679 / CVE-2026-86681 / CVE-2026-86683 / CVE-2026-86708 |
| CVEs | CVE-2026-86677, CVE-2026-86678, CVE-2026-86679, CVE-2026-86681, CVE-2026-86683, CVE-2026-86708 |
| Authoritative release date | 2026-09-23 13:11:31.276 UTC |
| Authority revision date | 2026-09-23 15:24:28.876 UTC |
| Affected versions | 86677/86678/86679/86683: main-track builds 182000 and below. 86681/86708: main-track builds 182200 and below. All six vendor tables separately list 181104-181109 and 182001-182009 as fixed builds. Apply those exceptions and the relevant edition/plugin scope; do not flatten the tables into a single numeric interval. |
| Fixed version | 86677/86678/86679/86683: 182100 and later on the applicable main track.86681/86708: 182300 and later on that track.Older fixed exceptions listed by each vendor page: 181104-181109 and 182001-182009. Confirm the supported service pack for the installed track; 182100 alone does not resolve all six. |
| CVSS base score | 7.1 / 7.6 / 8.1 / 8.8 / 10 (CVSS v3.1) |
| CVSS severity | High to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Enterprise and plugin identity: CVE-2026-86677 permits unauthorized managed-server registration and attacker-controlled SQL through Enterprise synchronization, potentially escalating to Central administrator and service-level code execution. 86678 exposes another user's API key through the Applications Manager Plugin.
Assigned monitor scope: 86679 permits deletion of unassigned service monitors; 86681 permits running configured MBean actions against unassigned monitors. 86683 permits unauthorized global proxy changes, potentially redirecting monitoring traffic.
Installer credential: 86708 concerns a Google Cloud service-account key used for push notifications that could be extracted from the public installer. ManageEngine says it replaced the key and limited the replacement's permissions. The retrieved advisory does not explicitly confirm revocation of the old key; updating an installation is not evidence that every copy of a disclosed credential is unusable.
What To Validate Now
- Inventory. Record standalone/Enterprise/Plugin role, exact build and track, Central/Probe relationships, API-key access, monitor assignments, configured MBean actions, proxy destinations and the owner responsible for vendor-key follow-up.
- Establish applicability. Use the six per-CVE tables and fixed exceptions above. Distinguish the Enterprise synchronization and Plugin profile endpoints from general monitor authorization; evaluate the public-installer exposure separately from authenticated-user flaws.
- Remediate. Deploy the supported service pack covering all applicable issues and confirm any required Central/managed-server sequence with ManageEngine. Review unexpected registrations, monitor deletions and proxy changes. Handle potentially disclosed customer credentials under the approved incident process; obtain vendor confirmation for revocation/restriction of its installer key.
- Validate. In staging, use synthetic users, monitors and harmless MBean actions to verify role and assignment boundaries, plus ordinary monitoring and plugin login. Never execute administrative actions on real monitored systems or extract/use the disclosed cloud key as a test.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
