CVE-2026-86708: Zohocorp ManageEngine Applications Manager

Critical severity, CVSS 10.0. EPSS: 1.2% chance of exploitation in the next 30 days.

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

Affected products

• Zohocorp ManageEngine Applications Manager: before 182300 (fixed in 182300)

Published 2026-09-23. Last modified 2026-09-24.