{"id":"CVE-2026-12591","kind":"vulnerability","aliases":["CVE-2026-12591"],"related":[],"title":"ManageEngine M365 Manager Plus: technician privilege escalation leads to remote code execution","description":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.","summary":"ManageEngine M365 Manager Plus versions below 4818 do not check permissions properly in the delegated administration interface. An authenticated technician can escalate privileges beyond their intended scope, which could lead to remote code execution during administrative processing.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["m365-manager-plus","manageengine","microsoft-365","self-hosted","vendor"],"not_affected_if":["build-4818-or-later","no-delegated-technician-accounts"],"how_to_check":"- Check the installed build number in the product's About page or install directory against `4818`","fix":"- ManageEngine M365 Manager Plus: upgrade to `4818` or later","status":"open","published_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","triaged_at":"2026-11-12T07:38:04+00:00","updated_at":"2026-11-12T07:38:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T07:38:04Z","model":"claude-haiku-5-5","output":{"fix":"- ManageEngine M365 Manager Plus: upgrade to `4818` or later","reach":"network","title":"ManageEngine M365 Manager Plus: technician privilege escalation leads to remote code execution","impact":"high","summary":"ManageEngine M365 Manager Plus versions below 4818 do not check permissions properly in the delegated administration interface. An authenticated technician can escalate privileges beyond their intended scope, which could lead to remote code execution during administrative processing.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","m365-manager-plus","microsoft-365","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Technician escalates privileges and runs code on the server","analyst_note":"Confirm the affected build range and fixed version from the Zoho advisory; the NVD entry gives only the 4818 threshold and the sources do not say how reachable the delegated interface is.","how_to_check":"- Check the installed build number in the product's About page or install directory against `4818`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["build-4818-or-later","no-delegated-technician-accounts"],"who_is_affected":"Organizations running M365 Manager Plus below build 4818 where technicians hold delegated administration accounts. Exposure depends on who holds technician credentials; the sources do not say how many deployments are reachable from outside the network.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4552,"output_tokens":548,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-12591':15A,18A '-2026':14A,17A '-365':25B '4818':36B,74C 'administr':45B,65B,89C,106C 'affect':76C 'authent':48B,79C 'beyond':53B,94C 'check':39B 'code':11A,62B,103C 'could':58B,99C 'cve':13A,16A 'deleg':44B,88C 'escal':7A,51B,92C 'execut':12A,63B,104C 'exploit':82C 'host':28B 'insuffici':83C 'intend':55B,96C 'interfac':46B,90C 'lead':8A,59B 'm365':2A,20B,31B,69C 'm365-manager-plus':19B 'manag':3A,21B,32B,70C 'manageengin':1A,23B,30B,68C 'may':81C 'microsoft':24B 'permiss':40B,84C 'plus':4A,22B,33B,71C 'privileg':6A,52B,93C 'process':66B,107C 'proper':41B 'remot':10A,61B,102C 'result':100C 'scope':56B,97C 'self':27B 'self-host':26B 'technician':5A,49B,80C 'valid':85C 'vendor':29B 'version':34B,72C 'zohocorp':67C","nicknames":[],"mitigations":[],"who_affected":"Organizations running M365 Manager Plus below build 4818 where technicians hold delegated administration accounts. Exposure depends on who holds technician credentials; the sources do not say how many deployments are reachable from outside the network.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","m365managerplus","manageengine","microsoft365","selfhosted","vendor"],"campaign_type":null,"search_a":"'-12591':15A,18A '-2026':14A,17A 'code':11A 'cve':13A,16A 'escal':7A 'execut':12A 'lead':8A 'm365':2A 'manag':3A 'manageengin':1A 'plus':4A 'privileg':6A 'remot':10A 'technician':5A","search_b":"'-365':25B '4818':36B 'administr':45B,65B 'authent':48B 'beyond':53B 'check':39B 'code':62B 'could':58B 'deleg':44B 'escal':51B 'execut':63B 'host':28B 'intend':55B 'interfac':46B 'lead':59B 'm365':20B,31B 'm365-manager-plus':19B 'manag':21B,32B 'manageengin':23B,30B 'microsoft':24B 'permiss':40B 'plus':22B,33B 'privileg':52B 'process':66B 'proper':41B 'remot':61B 'scope':56B 'self':27B 'self-host':26B 'technician':49B 'vendor':29B 'version':34B","search_c":"'4818':74C 'administr':89C,106C 'affect':76C 'authent':79C 'beyond':94C 'code':103C 'could':99C 'deleg':88C 'escal':92C 'execut':104C 'exploit':82C 'insuffici':83C 'intend':96C 'interfac':90C 'm365':69C 'manag':70C 'manageengin':68C 'may':81C 'permiss':84C 'plus':71C 'privileg':93C 'process':107C 'remot':102C 'result':100C 'scope':97C 'technician':80C 'valid':85C 'version':72C 'zohocorp':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12591","severity":null,"published_at":"2026-11-12T07:16:47+00:00","modified_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","fetched_at":"2026-11-12T07:37:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}