CVE-2026-12591: ManageEngine M365 Manager Plus Privilege Escalation Fixed in 4818

TL;DR

Zoho published eight ManageEngine CVEs on November 12, 2026, and the top one scores 9.9. These ManageEngine critical vulnerabilities hit M365 Manager Plus, the ServiceDesk Plus family and DDI Central. Two can lead to remote code execution, and one needs no login at all.

CVE-2026-12591 lets a technician in M365 Manager Plus escalate privileges and possibly run code. CVE-2026-12507 enables code execution through ServiceDesk Plus reports, and six DDI Central bugs expose DNS and DHCP control. Zoho reports no exploitation, and none appear in CISA’s KEV catalog.

Notable CVEs

Why It Matters

These products sit close to the core of IT operations. M365 Manager Plus administers Microsoft 365 tenants, while ServiceDesk Plus runs help desks. DDI Central controls DNS, DHCP and IP address management. Therefore, an attacker who abuses them could reroute traffic or run commands on key servers.

Most of these ManageEngine critical vulnerabilities need a valid account first. Still, that bar is low in large organizations, where help desk staff and technicians hold many accounts. A single phished login could open the door. Notably, DDI Central’s top flaw removes even that step.

How the Attack Works

M365 Manager Plus

According to the M365 Manager Plus advisory, a technician can abuse weak permission checks in the delegated administration interface. As a result, they can “escalate privileges beyond their intended scope.” Zoho warns this “could result in remote code execution during administrative processing.”

ServiceDesk Plus Family

CVE-2026-12507 (CVSS 9.1) sits in the Reports module. A user with the Create Query Reports permission can send crafted database queries. The ServiceDesk Plus advisory says this lets them “execute arbitrary commands on the underlying server.” The high-privilege requirement limits who can attack.

DDI Central

CVE-2026-19422 (9.1) is the only unauthenticated bug. It hits the Windows DNS and DHCP agent sync APIs. Per the DDI Central advisory, an attacker can “impersonate onboarded Windows servers” and change DNS and DHCP settings.

Two more flaws, CVE-2026-19421 and CVE-2026-75869, allow PowerShell injection. Crafted TXT records or DNS suffix values can lead to commands on managed Windows servers. The last three let non-admin users change DHCP options and filter lists, or delete DNS zones outside their scope.

Affected Versions

• M365 Manager Plus below build 4818
• ServiceDesk Plus below 15290
• ServiceDesk Plus MSP and SupportCenter Plus below 15150
• AssetExplorer below 7860
• DDI Central below 6301

Patch and Mitigation

Upgrade each product to at least the build listed above. Zoho’s records name no workaround. Meanwhile, review who holds technician roles and the Create Query Reports permission. On DDI Central, limit network access to the agent sync APIs until you patch. Finally, prioritize these ManageEngine critical vulnerabilities on internet-facing servers.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.