CVE-2026-12591 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine M365 Manager Plus versions below 4818 do not check permissions properly in the delegated administration interface. An authenticated technician can escalate privileges beyond their intended scope, which could lead to remote code execution during administrative processing.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running M365 Manager Plus below build 4818 where technicians hold delegated administration accounts. Exposure depends on who holds technician credentials; the sources do not say how many deployments are reachable from outside the network.
Not affected if build-4818-or-later, no-delegated-technician-accounts
Who cares m365-manager-plus, manageengine, microsoft-365, self-hosted
48184818 or laterZohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.