by Kastro
Paper/Archive/CVE-2026-12591

CVE-2026-12591

Zohocorp M365 Manager Plus — Privilege Escalation

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 77.0.770 × 2015.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.

Affected

ProductAffectedFixed inSource
M365 Manager Plus< 48184818CNA

Scores by source

Zohocorp (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refmanageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html