Multiple Zoho ManageEngine products suffer from local privilege escalation due to…
Priority LOW 38CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.
Why it matters now
EPSS 0.01724 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_analytics_plus:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_browser_security_plus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.380:*:*:*:*:*:*:* | 10.0.380 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:12.0.2:*:*:*:*:*:*:* | 12.0.2 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_firewall:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_key_manager_plus:5.6:*:*:*:*:*:*:* | 5.6 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_mobile_device_manager_plus:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_o365_manager_plus:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_analytics_plus:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_browser_security_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.380:*:*:*:*:*:*:* Versions 10.0.380 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:12.0.2:*:*:*:*:*:*:* Versions 12.0.2 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_firewall:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_key_manager_plus:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_mobile_device_manager_plus:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_o365_manager_plus:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Zohocorp
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_opmanager:12.3:*:*:*:*:*:*:* | 12.3 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_oputils:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:*:*:*:*:*:*:* | 9.9 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_patch_manager_plus:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:*:*:*:*:*:*:* | 10.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_vulnerability_manager_plus:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_opmanager:12.3:*:*:*:*:*:*:* Versions 12.3 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_oputils:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:*:*:*:*:*:*:* Versions 9.9 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_patch_manager_plus:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_vulnerability_manager_plus:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12133
- 2026-10-03 Alias added: GHSA-69r6-frgh-wc7c
References
More Zohocorp Manageengine Analytics Plus vulnerabilities
- TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-08640 SQL injection in Zohocorp Analytics Plus CVSS 3.1HIGH 8.8
- TI-2020-14120 Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho… CVSS 3.1CRITICAL 9.8
- TI-2024-34996 Sensitive data exposure in ManageEngine Analytics Plus CVSS 3.1HIGH 8.1
- TI-2020-14119 Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics… CVSS 3.1HIGH 7.5
- TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5
Sources
- CVE-2019-12133 · CVE Program
- CVE-2019-12133 · NVD
- FIRST EPSS
- GHSA-69r6-frgh-wc7c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences