Unauthenticated Remote Code Execution in ManageEngine ADAudit Plus by Zohocorp
CVE-2026-6516

10CRITICAL

Key Information:

Vendor

Zohocorp
Status
Manageengine Adaudit Plus
Vendor
CVE Published:
23 July 2026

What is CVE-2026-6516?

A security vulnerability has been identified in Zohocorp's ManageEngine ADAudit Plus, where versions prior to 8606 are prone to unauthenticated remote code execution. This issue arises from a flaw in the agent API that allows attackers to execute arbitrary code without authentication, posing a significant risk to systems utilizing this product. It is advisable for users to update to the latest version to mitigate potential threats associated with this vulnerability.

Affected Version(s)

ManageEngine ADAudit Plus 0 < 8606

References

https://www.manageengine.com/products/active-directory-au...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.