Arbitrary File Deletion Vulnerability in ZohoCorp ManageEngine Endpoint Central
CVE-2025-5496

3.3LOW

Key Information:

Vendor

Zohocorp
Status
Endpoint Central
Vendor
CVE Published:
21 October 2025

What is CVE-2025-5496?

An arbitrary file deletion vulnerability exists in the agent setup component of ZohoCorp ManageEngine Endpoint Central, which affects specific versions of the software. This flaw could allow unauthorized users to delete files that are critical to system operation, potentially leading to further security issues such as local privilege escalation. It is essential for users of the affected versions to upgrade to the latest releases to mitigate this risk.

Affected Version(s)

Endpoint Central 0 < 11.4.2508.14

Endpoint Central 0 < 11.4.2516.06

Endpoint Central 0 < 11.4.2518.01

References

https://www.manageengine.com/products/desktop-central/kb/...

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-5496 : Arbitrary File Deletion Vulnerability in ZohoCorp ManageEngine Endpoint Central