CVE-2026-12591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12591", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-06-18T09:09:27.284Z", "datePublished": "2026-11-12T06:55:31.695Z", "dateUpdated": "2026-11-12T06:55:31.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-11-12T06:55:31.695Z"}, "title": "Privilege Escalation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 \u2013 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 \u2013 Privilege Abuse"}]}], "affected": [{"vendor": "Zohocorp", "product": "M365 Manager Plus", "versions": [{"status": "affected", "version": "0", "lessThan": "4818", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:m365_manager_plus:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "4818"}]}]}], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0M365 Manager Plus\u00a0versions below\u00a04818\u00a0is affected by\u00a0an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Zohocorp ManageEngine&nbsp;</span>M365 Manager Plus<span>&nbsp;versions below&nbsp;</span>4818<span>&nbsp;is affected by&nbsp;</span>an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}]}], "references": [{"url": "https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "M365 Manager Plus", "vendor": "Zohocorp", "versions": [{"lessThan": "4818", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0fc0942c-577d-436f-ae8e-945763c79b02"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0M365 Manager Plus\u00a0versions below\u00a04818\u00a0is affected by\u00a0an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}], "id": "CVE-2026-12591", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}, "published": "2026-11-12T07:16:47.260", "references": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "url": "https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}], "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4818)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "M365 Manager Plus", "source": "cna", "vendor": "Zohocorp"}, "product": "m365_manager_plus", "vendor": "zohocorp"}], "created": "2026-11-13T00:45:11.869599+00:00", "updated": "2026-11-13T00:45:11.869616+00:00", "vendors": ["zohocorp", "zohocorp$PRODUCT$m365_manager_plus"]}