Vulnerability · Published Sep 23, 2026 · Assigned by Zohocorp
CVE-2026-86708Sensitive data exposure
Critical 10.0
In plain English
A critical-severity security flaw in ManageEngine Applications Manager from Zohocorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.7%top 13.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | ManageEngine Applications Manager | 0 – before 182300 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N