Vulnerability details
CVE-2026-76979
Zohocorp ManageEngine Firewall AnalyzerZohocorp ManageEngine OpManager
XML Injection vulnerability
CVSS 3.1
7.7High
Official description
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.7High | 3.1 | CVEProject cvelistV5 (CNA) (Zohocorp) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Zohocorp | ManageEngine Firewall Analyzer | v < 12.8.710 | CVEProject cvelistV5 (CNA) |
| Zohocorp | ManageEngine OpManager | v < 12.8.710 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-23
- Last updated
- 2026-09-23
- State
- Published
- Assigner (CNA)
- Zohocorp
Exploit prediction (EPSS)
2.07%
Probability of exploitation in 30 days
81.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-91XML injection (aka blind XPath injection)