CVE-2026-86678 — Broken Authentication vulnerability

CVE-2026-86678

Broken Authentication vulnerability PUBLISHED

Description (CNA)

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.

Affected (CNA)

Vendor / product	Versions
Zohocorp / ManageEngine Applications Manager	affected 0 before 182100

CWE

CWE-639

References

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.