---
id: "CVE-2026-12591"
page: "https://infrastack.ai/live/CVE-2026-12591"
kind: "vulnerability"
aliases: ["CVE-2026-12591"]
title: "ManageEngine M365 Manager Plus: technician privilege escalation leads to remote code execution"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["m365-manager-plus", "manageengine", "microsoft-365", "self-hosted", "vendor"]
not_affected_if: ["build-4818-or-later", "no-delegated-technician-accounts"]
published_at: "2026-11-12T07:16:47+00:00"
first_seen_at: "2026-11-12T07:37:03+00:00"
updated_at: "2026-11-12T07:38:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12591", "first_seen_at": "2026-11-12T07:37:03+00:00"}]
exploit_sources: []
---

# ManageEngine M365 Manager Plus: technician privilege escalation leads to remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-12591 (this .md is for agents)

ManageEngine M365 Manager Plus versions below 4818 do not check permissions properly in the delegated administration interface. An authenticated technician can escalate privileges beyond their intended scope, which could lead to remote code execution during administrative processing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed build number in the product's About page or install directory against `4818`

## Fix

- ManageEngine M365 Manager Plus: upgrade to `4818` or later

## Timeline

- 2026-11-12T07:37:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12591

## From the sources

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_