ManageEngine ITOM Updates Address Eleven Vulnerabilities
Tech GuruQuick Answer
These eleven ManageEngine advisories cover different ITOM products, editions, plugins and release tracks. A build number above an early 12.8 fix is not automatically safe: the current vendor tables also identify later affected intervals and 12.9 fixes. Inventory the exact edition and enabled modules, then follow each applicable advisory's upgrade path. In particular, the MSP notification-profile fix is 128711 or 129125 for the listed tracks, not 128710.
Confirm Scope And Apply The Supported Fix
What to do now: map Central/Probe installations, MSP customer roles, APM and Firewall Analyzer plugins, Configlet users and syslog listener exposure. Restrict administrative APIs and untrusted syslog senders while planning a vendor-supported update covering every applicable issue. Preserve evidence of unexpected privilege changes, outbound CLI sessions and report modifications.
Source recheck: October 2, 2026 UTC, against all eleven current ManageEngine vendor advisories. Their expanded matrices supersede the original merged early-build summary; deployed applicability and remediation still require local evidence.
Scope And Authority
| Product scope | Advisory-specific OpManager, Enterprise, Nexus, Nexus Enterprise, MSP, Firewall Analyzer, NetFlow Analyzer and Network Configuration Manager editions/modules. The linked vendor tables control scope; not every CVE affects every product. |
|---|---|
| Advisory | CVE-2026-12370 / CVE-2026-14913 / CVE-2026-15358 / CVE-2026-19599 / CVE-2026-75825 / CVE-2026-76978 / CVE-2026-76979 / CVE-2026-76980 / CVE-2026-84787 / CVE-2026-84789 / CVE-2026-84791 |
| CVEs | CVE-2026-12370, CVE-2026-14913, CVE-2026-15358, CVE-2026-19599, CVE-2026-75825, CVE-2026-76978, CVE-2026-76979, CVE-2026-76980, CVE-2026-84787, CVE-2026-84789, CVE-2026-84791 |
| Authoritative release date | 2026-09-23 11:20:09.186 UTC |
| Authority revision date | 2026-09-23 14:44:07.748 UTC |
| Affected versions | Use the per-CVE product/edition and disjoint build intervals in the linked vendor tables. The old aggregate list ending at 12.8.710 is incomplete: several advisories include later 12.8/12.9 tracks. Compact builds such as 128711 must be matched to the vendor's own notation, not treated as an unrelated version family. |
| Fixed version | 12370: 12.8.668 for builds through 12.8.667; 12.8.736 for 12.8.676-12.8.722 and 12.8.732-12.8.735; 12.9.101 for 12.8.746-12.9.100. 14913: 12.8.670, 12.8.709, 12.8.737 or 12.9.106, depending on the vendor interval. 15358: 12.8.671, 12.8.709, 12.8.738 or 12.9.107 for the specified Enterprise/MSP Probe tracks. 19599 (MSP): 128711 for 128166-128709; 129125 for 128718-129001, 129100-129108 and 129117-129122. 75825 (APM): 12.8.711, 12.9.124 or 12.9.134 for the listed tracks. 76978/76979/76980: 12.8.710 or 12.9.124. 84787/84789/84791: 12.8.711, 12.9.125 or 12.9.135. These are track-specific fixes, not a menu of interchangeable packages. Check the full linked matrix and supported upgrade sequence for every applicable CVE. |
| CVSS base score | 7.1 / 7.4 / 7.5 / 7.6 / 7.7 / 8.1 / 8.8 / 9.9 (CVSS v3.1) |
| CVSS severity | High to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Server and plugin boundaries: 12370 concerns Configlet template injection; 14913 concerns Rule Management Search Reports SQL injection; 15358 concerns legacy Smart Update Manager traversal on the listed Probe editions. 19599 lets an MSP customer administrator misuse notification APIs intended for the MSP Central administrator. 75825 concerns a logged-in user with access to the APM module being signed into the plugin as another account, not a universally anonymous login bypass.
Managed firewall boundaries: 76978 can run CLI commands on a monitored firewall using stored credentials; its fix removes Diagnose Settings. 76979 affects uploaded configurations in Compare Policies. 76980 can use incoming syslog source information to redirect a later CLI connection and expose firewall credentials. These apply to Firewall Analyzer or its enabled plugin as listed by the vendor.
Role and device scope: 84787 concerns privilege settings in Report Profile imports; 84789 and 84791 concern alerts and report schedules for firewalls outside a user's assigned scope. Patching must be followed by a review of existing unauthorized changes, not only a successful service restart.
What To Validate Now
- Inventory. Record exact product/edition/build, Central versus Probe role, enabled APM/Firewall Analyzer modules, MSP customer permissions, managed firewall scope, Configlet/import grants and reachable syslog listeners.
- Establish applicability. Match every relevant CVE to its current vendor table, including later tracks. A disabled APM plugin excludes that specific plugin path, not the separate Configlet, Probe or firewall issues.
- Remediate. Obtain the supported upgrade pack for the exact edition and track, covering all applicable CVEs. Review feature removal and plugin compatibility, back up configuration and coordinate Central/Probe rollout. Do not install an early 12.8 fix as a downgrade for a later affected track.
- Validate. Use staging and synthetic tenants/devices to check customer-versus-Central administration, APM identity binding, report import roles and firewall assignment boundaries. Verify syslog does not change the trusted CLI destination; never test by sending commands to a live firewall or disclosing real device credentials.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- CVE-2026-12370
- CVE-2026-14913
- CVE-2026-15358
- CVE-2026-19599
- CVE-2026-75825
- CVE-2026-76978
- CVE-2026-76979
- CVE-2026-76980
- CVE-2026-84787
- CVE-2026-84789
- CVE-2026-84791
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
