CVE-2026-86678 HIGH

CVE-2026-86678: Broken Authentication vulnerability

Vendor Zohocorp

Product ManageEngine Applications Manager

Weakness CWE-639 · IDOR

Published September 23, 2026

Last update September 24, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.

Key dates

02Disclosure timeline

September 23, 2026 CVE published

September 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-86678 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities

04Related CVE

CVE-2026-9341 Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter CVE-2026-61971 WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-12400 FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access