TI-2016-07755 Aliases CVE-2016-9489 GHSA-76xw-q73v-w245

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass

MEDIUM 41CWE-269Published 2018-07-13 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-269 and CWE-264.

Summary

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

Why it matters now

EPSS 0.01659 76th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ManageEngine	Applications Manager	12; 13	—	No fix listed	CNA

Applications Manager VendorManageEngine Affected 12; 13 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:12.0:::::::*	12.0	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:13.0:::::::*	13.0	Vulnerable	Zohocorp

cpe:2.3:a:zohocorp:manageengine_applications_manager:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-9489
2026-10-03 Alias added: GHSA-76xw-q73v-w245

References

Advisory 2

TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3

See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences