CVE-2026-86708 CRITICAL

CVE-2026-86708: Sensitive data exposure

Vendor Zohocorp
Product ManageEngine Applications Manager
Weakness CWE-321
Published September 23, 2026
Last update September 24, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

Key dates

02Disclosure timeline

September 23, 2026 CVE published
September 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-3947 Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure CVE-2023-3404 ProfileGrid <= 5.5.0 - Hardcoded Encryption Key CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution CVE-2023-3371 EmbedPress <= 3.7.3 - Sensitive Information Exposure CVE-2024-13773 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure