ManageEngine ADAudit Plus Unauthenticated RCE: CVE-2026-6516, CVSS 10

On July 23, 2026, CVE-2026-6516 was published in the US National Vulnerability Database. The affected product is ManageEngine ADAudit Plus from Zohocorp, and the affected range is every build below 8606. The severity score is CVSS 10.0 — a perfect ten out of ten.

The substance is just as blunt. Zoho's official security advisory says it fixed "vulnerabilities in ADAudit Plus Agent APIs that could allow authentication bypass and path traversal," and describes the impact as "an unauthenticated adversary could combine these vulnerabilities to potentially achieve remote code execution." In plain terms: someone with no credentials at all can run commands of their choosing on that server, over the network.

What makes this genuinely nasty is not the number, though. It is where the server sits. ADAudit Plus exists to watch, record, and report on changes inside Active Directory (AD) — the system that holds a company's employee accounts and computers. It is an always-on server that runs with a view across the entire corporate identity layer. When that box falls first, the damage does not stop at one machine.

One thing to state up front: as of July 29, 2026, at the time of writing, there are no reports that this vulnerability has been used in a real attack. The history of past ManageEngine incidents and the status of this particular CVE are kept clearly separate below.

CVE-2026-6516 at a glance

Only values confirmed in primary sources — the NVD record and Zoho's official advisory — are listed here.

A quick read of the vector: AV:N means it reaches over the network, PR:N means no privileges are needed, and UI:N means nobody has to be tricked into clicking anything. With those three lined up, the attacker's effort drops to almost nothing. On top of that, S:C (Scope Changed) is the assessment that the damage does not stay inside the application — it spills outward, and that is what pushes the score to 10.0. What that means for a server that reaches across all of AD is covered further down.

The first thing an intruder wants to silence is the audit log itself

The people who hunt for servers like this are access brokers who sell footholds into corporate networks, and the ransomware crews who buy from them and move on to the real attack. They rarely research one specific company. They sweep IP ranges mechanically and scoop up every server still carrying a known hole. CVSS 10.0 with no authentication required is the combination those automated sweeps catch most easily. CISA's own assessment of this CVE marks it automatable: yes with technicalImpact: total.

An intruder's first move on an ADAudit Plus box is probably duller than you would imagine, and worse for it. They rewrite or delete the audit logs so their own footprints disappear first. ADAudit Plus is the box that collects and stores "who created which account when, who added which privilege, who opened which file." From an intruder's point of view, that is the recorder attached to the camera pointed at them. Silencing it before making noise is simply the sensible order of operations. And because this product is normally configured with a high-privilege account so it can read AD, taking the server also widens the attacker's next set of moves.

When an AD audit server falls, what gets lost depends on where you stand. For ordinary users of the company's services, the realistic impact is data being carried out through a hijacked employee account. For the organization running the server, the loss comes in two layers. One is attackers reaching the endpoints and file servers under AD. The other is losing the very material needed to reconstruct what happened afterwards. Being unable to explain how someone got in is a serious problem when you have to report to customers, partners, and regulators. That is exactly why checking your build number is worth doing today.

This shape of attack has precedent. ManageEngine products have been used in real attacks repeatedly, and several appear in the KEV catalog, CISA's list of vulnerabilities confirmed to be exploited in the wild. The specific CVE IDs and dates are laid out later under "ManageEngine has a record." To be clear in advance, though: there is no evidence that CVE-2026-6516 itself has been used.

How much has actually been disclosed

CVE-2026-6516: authentication bypass and path traversal in the agent API

The NVD description, in full, is a single sentence.

Zoho's advisory goes slightly further, describing a combination of two defects. One is authentication bypass — an endpoint that should require a login can be talked to without one. The other is path traversal — slipping "go up one directory" style tricks into a file path so that reads or writes land somewhere unintended. Chain those two and you get a plausible route: drop a file anywhere from outside, then get it executed.

One inconsistency between primary sources is worth recording. The weakness class registered in NVD is CWE-78 (OS command injection), but Zoho's advisory only describes authentication bypass and path traversal, never mentioning command injection. This reads less like an error on either side and more like a single representative CWE being attached to a chain of several defects. Whether the final stage is genuinely OS command execution, or execution via a written file, cannot be determined from public information.

The origin of the score is also worth pinning down. The NVD status for this CVE is Awaiting Analysis, and both the CVSS 10.0 and the CWE-78 are marked Secondary — meaning they were assigned by Zohocorp, the CNA that issued the CVE. This is not NVD's own independent scoring. A vendor giving its own product a perfect ten reads as corroboration of severity rather than the opposite, but it is not a third-party-verified 10.0, and that distinction should stay intact.

Looking at exploitability from another angle, EPSS — the estimated probability of exploitation within the next 30 days — stood at 0.04729 (about 4.7%) on July 28, with a percentile of 0.909. Low in absolute terms, but in the top 10% of all CVEs. EPSS reacts strongly to public proof-of-concept code and observed attacks, so treat this as a number with plenty of room to jump the moment a PoC appears.

Equally clear is what has not been disclosed. Which agent API endpoint is affected, what the request looks like, whether any preconditions apply (agent deployment being enabled, for example) — Zoho has published none of it. The only reference attached to the NVD record is the vendor advisory itself; no technical write-up, no PoC. In other words, the details of working attack code are not out in the world. That is where things stand.

The fix shipped in April. The CVE ID arrived in July.

The dates are the easiest thing to miss here. Zoho's advisory and the ADAudit Plus release notes both record build 8606 as released on April 17, 2026. The release note entry is one line: "Critical security vulnerability (CVE-2026-6516) in the ADAudit Plus Agent APIs has been fixed."

So the fixed build has been available for over three months, and only the NVD publication slipped to July 23. For organizations that track vulnerabilities by CVE ID, that is a trap. An operator who read the April release notes has already acted; a team that picks things up through a monthly CVE review only learns this exists at the end of July. We came across this case ourselves while re-checking what fell through during roughly 13 hours when our CVE subscription pipeline was down across July 23 and 24.

Why "where it sits" is the real problem

Here is what ADAudit Plus does, in the product page's own terms: Active Directory change auditing, logon monitoring, account lockout analysis, privileged user monitoring, file server auditing, and compliance reporting for frameworks such as SOX, HIPAA, PCI DSS, and ISO 27001. In short, it is the thing that collects "who did what inside the company" and keeps it as evidence.

To do that job, the ADAudit Plus server opens paths outward. According to the official port guide, it reaches domain controllers (the servers that hold the employee accounts themselves) over LDAP 389 and 636, global catalog 3268 and 3269, and Kerberos 88, and it reaches monitored workstations and file servers over RPC 135, SMB 445, and NetBIOS 137 through 139. This is a server with pre-opened routes toward the most important machines on the internal network.

That is where S:C (Scope Changed) in the CVSS vector earns its place. The breakage does not stay inside the ADAudit Plus application; it extends to whatever privileges and connections the application holds. Losing the audit server does not mean losing the AD auditing feature — it means handing an attacker a position from which all of AD is reachable. The same "the product meant to protect becomes the entrance" pattern showed up when the security monitoring platform itself was the target, in the Wazuh vulnerabilities.

Where to find your build number

ADAudit Plus is versioned by build number, not by a "x.y.z" style version string. Without knowing your number, you cannot tell whether any of this applies to you. ManageEngine's official service pack page documents two ways to check. Only steps confirmed in primary sources are listed.

• Under the product version: log in to the ADAudit Plus web console and click License in the top pane. The build number appears below the product version.
• Via support info: in the web console, open the Support tab, click More on the "Support Info" tile, then expand Machine Details under "Basic Check." The Build Number is listed at the bottom (the database type in use is shown in the same place).

The agents need a separate check. Zoho's advisory instructs you to upgrade any Windows agent earlier than version 7060, and to upgrade all Mac agents regardless of their current version. Agent versions are found under "Configuration → Agent Management → Manage" in the Installed Version column. Updating only the server means you have done half of what the advisory asks.

Note also that the service pack page warns that "depending on your current build number, you may need to apply a series of service packs before you can upgrade to the latest build." If your environment has been sitting on an old number, plan for more than a single patch window.

Build 8606 is not far enough

This is where the practical work actually lands. Build 8606 closes CVE-2026-6516, but at least three more vulnerabilities were fixed in later builds. Here is what the release notes let us confirm.

The entry in that table not to skip past is CVE-2026-11374. When ADAudit Plus is integrated with AD360 (ManageEngine's unified identity and access management product), the single sign-on path carried a flaw that allows account takeover without any credentials, scored CVSS 9.0. For ADAudit Plus, build 8702 and earlier are affected, and 8703 contains the fix. We cover it separately in ManageEngine AD360 SSO account takeover (CVE-2026-11374). ADSelfService Plus, RecoveryManager Plus, and M365 Manager Plus are affected through the same integration, so do not stop at ADAudit Plus.

The conclusion is a single line. Do not stop at 8606 — go to the current latest, build 8703 (released June 12, 2026; the product designation is ADAudit Plus 8.7). Zoho itself recommends moving to the latest version on its service pack page. Build 8703 also added SSL certificate validation for agent-to-server HTTPS communication, and made TLS settings and cipher choices configured in the UI apply to agent traffic as well. The plumbing of agent communication itself got tightened.

Internet-facing or not decides how fast you move

Because CVE-2026-6516 needs no authentication and works remotely, whether an attacker's traffic can reach the server essentially determines your risk. Per the official port guide, the default ports for the ADAudit Plus console and product web server are 8081 (HTTP) and 8444 (HTTPS). Agents talk to that same product web server — this reads from the fact that the 8703 changes target "agent-to-server HTTPS communication." The advisory does not state which port the agent API listens on, so that part is not asserted as fact here.

The split is straightforward.

• Exposed to the internet: act immediately. Configurations published without a reverse proxy or VPN are not unusual — teams want agents on remote-work machines to check in, or want audit reports readable from outside the office. In that case you are inside the range of automated scanning. Even just until the latest build is applied, consider restricting access to VPN-only or a source IP allowlist.
• Internal only: act on a plan. If the path is closed to the internal network, an attacker needs a foothold inside first, which buys you time. Time is not exemption, though. If this hole gets used during lateral movement, tampering with or wiping audit logs follows immediately. Handle it inside normal change management, with the priority raised.

"An internal management product ends up exposed, then gets breached without authentication" is a pattern we have followed repeatedly. Citrix NetScaler, Adobe ColdFusion, and SharePoint all involved edge products reachable without credentials that were used in real attacks and ended up in the KEV catalog. ManageEngine has joined that lineage before, which is the next section.

ManageEngine has a record

Searching CISA's KEV catalog (version 2026.07.27, 1,655 entries) turns up nine entries covering Zoho / ManageEngine products. Here they are with CVE IDs and dates.

Two of those nine — CVE-2021-40539 and CVE-2022-47966 — are flagged in the KEV catalog as having confirmed use in ransomware campaigns. KEV describes the former as "an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution" in ADSelfService Plus, which is structurally very close to CVE-2026-6516 and its agent API authentication bypass. The latter was unauthenticated code execution stemming from an outdated third-party component (Apache Santuario), and it hit multiple ManageEngine products at once.

ADAudit Plus itself has a past too. CVE-2022-28219 was unauthenticated code execution in the same product, fixed in build 7060 according to Zoho's advisory. The technical write-up from Horizon3.ai that found it published a route from XXE (abusing external references in XML) into Java deserialization, and released working proof-of-concept code. Their description at the time: the chain "often leads to host compromise as well as privileged AD credentials."

The absence of official technical detail on CVE-2026-6516 is not a guarantee that nobody has assembled attack code yet. In the 2022 case, the gap between the vendor fix and public proof-of-concept code was very short. ManageEngine products draw plenty of attention from security researchers, and patch diffing — working backwards from a fix to find the hole — has been applied to them repeatedly.

That said, no exploitation has been confirmed this time

The record and this case are separate things, so here is the line. As of July 29, 2026, there are no confirmed reports of CVE-2026-6516 being used in a real attack. Three pieces of evidence support that.

• It is not in the KEV catalog. We searched the catalog published July 27, 2026 (1,655 entries) and confirmed CVE-2026-6516 is absent. KEV only lists vulnerabilities CISA has confirmed to be exploited in the wild.
• CISA itself assesses exploitation as none. The NVD data includes an SSVC assessment by the CISA Coordinator dated July 23, 2026, where exploitation is none. In the same assessment, though, automatable is yes and technicalImpact is total — read as "not yet used, but if it is used, it can be automated and takes everything."
• No public PoC could be found. The only reference attached in NVD is the vendor advisory; no exploit code or technical analysis is registered. We could not find public proof-of-concept code on GitHub either.

ManageEngine products are a family with nine prior KEV listings. Whether this CVE joins them is worth watching continuously. Movement across the whole KEV catalog can be tracked in the CISA KEV dashboard.

Deployment in Japan, and how official bodies have handled it

We checked Japanese public advisories and Japanese-language coverage. The result is that nothing has been published yet.

• JVN iPedia: searching the MyJVN API for both "CVE-2026-6516" and "ADAudit" returned zero results (confirmed July 29, 2026). JVN iPedia carries no Japanese-language entry for this.
• JPCERT/CC and IPA: no advisory could be found.
• Japanese-language articles: full-text search on Hatena Bookmark and on Zenn returned zero hits for either the CVE ID or the product name.

In other words, this is the first Japanese-language coverage of this vulnerability at time of publication. Coverage outside Japan is thin as well — we could confirm only a short report from the UK site SystemTek and the mechanical inclusion in CISA's weekly vulnerability summary (SB26-208). Silence around a CVSS 10.0 is the pattern where a shortage of information turns directly into delayed remediation.

On deployment: ManageEngine reaches mid-sized and large enterprises in Japan through multiple resellers. Writing this off as "not many sites run ADAudit Plus" would be wrong. The more accurate framing is that for organizations that do run it, this 10.0 lands as the score of their own environment. That said, since public Japanese-language information on the product is close to nonexistent, some companies will have to start by checking their asset inventory to answer "do we even run this?"

Bought for auditing, used to erase the audit

What follows is the author's own view. Read it separately from the factual record above.

ADAudit Plus is usually not a product anyone was excited to buy. It gets procured as the means to satisfy an AD auditing requirement — for SOX compliance, for ISO 27001 certification, or in response to an internal audit finding. When the motivation for deployment is compliance, the center of gravity in operations tends to shift toward "are the reports coming out?" And if the monthly reports keep arriving, nobody notices that the server's build number is two years old.

The result is the shape of this very case. The server added for security becomes the least-updated server you own. And by its role, that server holds some of the widest privileges in the company. A business system gets an update plan because downtime hurts; an audit server can be stopped without touching this quarter's revenue, so it never even reaches the priority discussion. Behind nine accumulated KEV listings for ManageEngine products, I think there is exactly this operational habit of leaving management-plane servers for later.

A practical suggestion: carve audit and management products out into their own section of the asset inventory, and put "check the build number" into a standing quarterly task. ADAudit Plus added a "Security Hardening" screen in build 8520 that lets you inspect the security posture of your own deployment. The vendor has supplied the tool. It just is not being opened.

What we could corroborate, and what we could not

The steps that get you to build 8606 or later

There are only three steps. Open "License" in the web console and read the build number. If it is lower than 8703, use the service pack to reach 8703. Then open "Configuration → Agent Management → Manage" to check agent versions, upgrade any Windows agent earlier than 7060, and upgrade every Mac agent regardless of version. That covers CVE-2026-6516 plus the SQL injection, SSO takeover, and CSRF issues fixed afterwards, all in one pass.

If the update needs time, at least confirm in the meantime that 8081 and 8444 are not reachable from outside your network. Against an attack that requires no authentication, cutting the path is the only mitigation available on the spot.

This case is sitting far too quietly for how dangerous it is. CVSS 10.0, no authentication, remote code execution — layered on top of a server positioned to see all of Active Directory, with not a single Japanese-language advisory published yet. Since ManageEngine products already carry a stack of KEV listings, we will keep following three things: publication of a PoC, addition to KEV, and any domestic advisory.

References

• ▸ NVD - CVE-2026-6516 (published July 23, 2026; modified July 24)
• ▸ ManageEngine ADAudit Plus - Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516) fixed in build 8606 (fixed April 17, 2026)
• ▸ ManageEngine ADAudit Plus - Release Notes (entries for builds 8606, 8607, 8703)
• ▸ ManageEngine ADAudit Plus - Service Pack (how to find the build number; latest 8703)
• ▸ ManageEngine ADAudit Plus - Product and system ports (8081/8444 and others)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (version 2026.07.27, 1,655 entries)
• ▸ CISA - Vulnerability Summary for the Week of July 20, 2026 (SB26-208)
• ▸ FIRST - EPSS (CVE-2026-6516: 0.04729 as of July 28, 2026)
• ▸ ManageEngine ADAudit Plus - CVE-2022-28219 fixed in build 7060
• ▸ Horizon3.ai - CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus
• ▸ ManageEngine - Security Advisory CVE-2022-47966
• ▸ SystemTek - Zohocorp Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516) (July 24, 2026)
• ▸ JVN iPedia (no matching entry as of July 29, 2026)