NCSC-2026-0263 [1.00] [M/H] Vulnerability fixed in ManageEngine ADAudit Plus from ZohoCorp
ZohoCorp has fixed a vulnerability in ManageEngine ADAudit Plus. The vulnerability is located in the agent API of ManageEngine ADAudit Plus versions earlier than 8606. Due to improper validation in the API, attackers can execute arbitrary code remotely without authentication. All implementations with vulnerable versions are affected. ADAudit Plus is a tool that should not be publicly available. It is good practice to support such management tooling in a separate management environment. This limits the potential for large-scale exploitation.
CSIRTS triage
- What
- Improper validation in the agent API allows attackers to execute arbitrary code remotely without authentication.
- Who is affected
- All implementations of ManageEngine ADAudit Plus versions earlier than 8606 are affected.
- Urgency
- Remediation is critical due to the potential for remote code execution without authentication.
- Action
- Upgrade to version 8606 or later to address this vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch ManageEngine ADAudit Plus
Get an email when a new ManageEngine ADAudit Plus advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0263
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-65164.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-6516 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for ManageEngine ADAudit Plus
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30