Vulnerability · Published Sep 23, 2026 · Assigned by Zohocorp
CVE-2026-12370Remote Code Execution Vulnerability
High 7.6
In plain English
A high-severity security flaw in ManageEngine NetFlow Analyzer from Zohocorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)1.5%top 25.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | ManageEngine OpManager | 0 – before 12.8.668 |
| Zohocorp | ManageEngine NetFlow Analyzer | 0 – before 12.8.668 |
| Zohocorp | ManageEngine Network Configuration Manager | 0 – before 12.8.668 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L