Insufficient Driver Signature Validation in Zohocorp ManageEngine Malware Protection Plus
CVE-2026-14308

4.9MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Malware Protection Plus
Vendor
CVE Published:
13 October 2026

What is CVE-2026-14308?

Zohocorp's ManageEngine Malware Protection Plus, specifically versions prior to 1.0.64.12, suffers from a vulnerability concerning insufficient driver signature validation within the MEARWService. This lack of validation can potentially allow malicious actors to execute unsigned drivers, leading to unauthorized system access and heightened security risks. Organizations utilizing affected versions are strongly encouraged to upgrade to the latest release to mitigate potential threats.

Affected Version(s)

ManageEngine Malware Protection Plus 0 <= 1.0.64.12

References

https://www.manageengine.com/malware-protection/help/edr/...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeremy / Holly Sadler
.