Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-12591 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Zohocorp |
| Product | ManageEngine M365 Manager Plus |
| Vulnerability Type | missing authorization, privilege escalation to RCE (CWE-862) |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
In Zohocorp ManageEngine M365 Manager Plus versions below 4818, an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
According to the vendor advisory, the technician can thereby gain administrator access, which could lead to code execution on the server. The fix adds authorization checks to the affected APIs and sanitizes input values. The vendor rates the issue as “High”; NVD scores it 9.9 on the CVSS scale.
Required Actions
- Update M365 Manager Plus to build 4818 or later using the vendor service pack.
- Review technician accounts with delegated permissions and remove unnecessary ones.
- Check M365 Manager Plus audit logs for unexpected changes to technician roles and permissions.
Who Is Affected?
The vulnerability affects Zohocorp ManageEngine M365 Manager Plus build 4817 and earlier. M365 Manager Plus is used to administer, report on and audit Microsoft 365 environments (Exchange Online, Entra ID, Teams, SharePoint Online, OneDrive), often with tasks delegated to the helpdesk.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-12591 vulnerability?
CVE-2026-12591 is a missing authorization flaw (CWE-862) in the delegated administration interface of ManageEngine M365 Manager Plus that allows an authenticated technician to gain administrator privileges and execute code on the server. CVSS score: 9.9.
Does exploiting CVE-2026-12591 require authentication?
Yes, but a technician account with delegated permissions is enough — no administrator rights or interaction from another user are required.
How to protect against CVE-2026-12591?
Update M365 Manager Plus to build 4818 or later using the vendor service pack and review the technician accounts holding delegated permissions.
Who is affected by CVE-2026-12591?
Organizations running ManageEngine M365 Manager Plus build 4817 or earlier.
