CVE-2026-125919.9Critical
CVE-2026-12591: Privilege Escalation
Zohocorp · M365 Manager Plus
Vendor fix available · Affected: Zohocorp M365 Manager Plus · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
1.7%probability of exploitation in the next 30 days
77th percentile
050100
Higher than 77% of scored CVEs
9.9CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- Zoho fixes eight ManageEngine flaws, including CVE-2026-12591SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.