Zohocorp ManageEngine Endpoint Central vulnerabilities

13 CVEs affecting Zohocorp ManageEngine Endpoint Central, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85640, published 2026-09-07.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-38868, published 2024-08-30. High severity, CVSS 8.3. EPSS: 0.8% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15
• CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…
• CVE-2026-3182, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.
• CVE-2024-9097, published 2025-02-05. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.
• CVE-2025-11248, published 2025-10-27. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain…
• CVE-2024-10203, published 2024-11-07. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
• CVE-2026-85640, published 2026-09-07. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component
• CVE-2026-77697, published 2026-09-07. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
• CVE-2026-77698, published 2026-09-07. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.
• CVE-2025-7473, published 2025-10-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

Latest

• CVE-2026-77699, published 2026-09-07. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.
• CVE-2025-5496, published 2025-10-21. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.
• CVE-2025-5494, published 2025-09-25. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.