Zoho ManageEngine vulnerabilities and fixes

CVEs that mention Zoho ManageEngine, ranked by priority. 4 tracked.

Zoho ManageEngine has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-11. Highest priority: CVE-2026-6516 (score 66/100).

• CVE-2026-6516 CRITICAL 10.0 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution
• CVE-2026-12571 CRITICAL 9.8 An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
• CVE-2026-3183 HIGH 7.1 Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication By
• CVE-2026-3182 MEDIUM 4.3 Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of

FAQ

How do I fix Zoho ManageEngine vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Zoho ManageEngine being exploited right now?

None of the tracked Zoho ManageEngine CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Zoho ManageEngine CVE should I patch first?

CVE-2026-6516 currently ranks highest (66/100): Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution .

← Back to latest CVEs