Zoho fixes eight ManageEngine flaws, including CVE-2026-12591

Zoho published details of eight ManageEngine vulnerabilities on 12 November 2026: three rated critical and five high, with CVE-2026-12591 scoring 9.9. The flaws affect M365 Manager Plus, the ServiceDesk Plus product family, AssetExplorer and DDI Central. Zoho reported no exploitation, and none of the vulnerabilities were listed in CISA’s Known Exploited Vulnerabilities catalogue.

In M365 Manager Plus, CVE-2026-12591 allows a technician to exploit weak permission checks in delegated administration to exceed their authorised privileges; Zoho warns that this could lead to remote code execution during administrative processing. CVE-2026-12507, rated 9.1, affects the Reports module in ServiceDesk Plus: a user with the Create Query Reports permission can submit crafted database queries to execute commands on the server. DDI Central has six flaws.

Its CVE-2026-19422, also rated 9.1, is unauthenticated and could let an attacker impersonate an onboarded Windows server and alter DNS and DHCP settings. CVE-2026-19421 and CVE-2026-75869 can enable command execution through crafted DNS values; three further flaws allow unauthorised changes to DHCP settings or DNS zones.

Zoho’s fixed builds are 4818 for M365 Manager Plus; 7860 for AssetExplorer; 15290 for ServiceDesk Plus; 15150 for ServiceDesk Plus MSP and SupportCenter Plus; and 6301 for DDI Central. Zoho listed no workaround. The supplied details recommend reviewing technician and report-query permissions, restricting access to DDI Central’s agent-sync APIs until patched, and prioritising internet-facing systems.