CVE-2026-12370

Executive Summary

CVE-2026-12370 is a Server-Side Template Injection (SSTI) vulnerability affecting Zoho ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below. The flaw resides in the Configlet processing component and can be leveraged by an authenticated attacker with low privileges to achieve remote code execution on the affected server. With a CVSS base score of 7.6, this represents a significant risk to organizations running these network management platforms, as successful exploitation grants high confidentiality impact and could disrupt critical infrastructure monitoring and configuration workflows.

Technical Analysis

The vulnerability is classified under CWE-1336, which denotes Improper Neutralization of Special Elements Used in a Template Engine, commonly referred to as Server-Side Template Injection (SSTI). In SSTI, user-supplied input is embedded directly into a server-side template without adequate sanitization, allowing an attacker to inject template directives that are evaluated by the template engine on the server. Depending on the template engine in use and its configuration, this can lead to arbitrary code execution, file read/write, or information disclosure.

In this instance, the affected component is "Configlet processing" within ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager. Configlets are configuration templates used in network device management to push standardized configurations to routers, switches, and other network equipment. The processing of these configlets appears to pass user-controlled data into a template engine without proper neutralization. An authenticated attacker with low privileges (indicated by CVSS PR:L) can supply malicious template syntax that the server evaluates during configlet rendering or processing.

The attack surface is network-accessible (AV:N), requires no user interaction (UI:N), and does not require a change in scope (S:U), meaning the vulnerable component and the impacted component are the same. The CVSS subscores indicate high confidentiality impact (C:H), low integrity impact (I:L), and low availability impact (A:L). This profile suggests that an attacker could exfiltrate sensitive configuration data, credentials, or files (high confidentiality), while the ability to modify data or cause service disruption is more constrained. The low integrity and availability impacts may reflect limitations in the template engine's capabilities or the specific context in which the SSTI is triggered.

The exact template engine used by ManageEngine for configlet processing is not specified in the available data. Consequently, specific injection payloads, function names, or API endpoints cannot be confirmed. However, the vulnerability class is well understood: successful SSTI in a Java-based application (ManageEngine products are typically Java-based) often allows attackers to execute arbitrary Java code via reflection, instantiate system processes, or read environment variables and files.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-12370. The attack chain described below is inferred from the vulnerability class and the limited details provided.

1. Reconnaissance and target identification: An attacker scans for internet-facing ManageEngine OpManager, NetFlow Analyzer, or Network Configuration Manager instances. Shodan dorks such as http.title:"OpManager" or http.html:"ManageEngine" can identify exposed servers. The attacker notes the version to confirm it is 12.8.667 or below.

2. Authentication and access: The CVSS vector indicates PR:L (low privileges required). The attacker must possess valid credentials for a low-privileged account. This could be obtained through phishing, credential stuffing, or purchasing leaked credentials. Once authenticated, the attacker navigates to the Configlet processing functionality within the application.

3. Triggering the SSTI: The attacker identifies an input field, parameter, or file upload mechanism used during configlet creation or processing that is rendered by a server-side template engine. They inject template syntax (e.g., ${...}, {{...}}, <%= ... %>, or similar, depending on the engine) into the configlet content or a related parameter. When the server processes the configlet, the template engine evaluates the injected expression.

4. Payload execution: At the vulnerability-class level, the injected template expression can be crafted to execute arbitrary code. For example, in a Java-based template engine, an attacker might use reflection to invoke Runtime.getRuntime().exec() or equivalent, leading to remote code execution. The specific payload depends on the template engine, which remains unidentified in available data. The attacker may use the execution to establish a reverse shell, download additional tooling, or exfiltrate sensitive files.

5. Post-exploitation impact: With code execution in the context of the ManageEngine service account, the attacker can access configuration files, database credentials, API keys, and network device credentials stored by the application. Given the high confidentiality impact, the primary objective is likely data exfiltration. The low integrity and availability impacts suggest that the attacker may have limited ability to alter configurations or cause downtime, but they could potentially disrupt network management operations.

It is important to note that the exact exploitation steps, payload syntax, and affected parameters are not detailed in the available intelligence. Organizations should treat this as a critical risk and prioritize mitigation, as SSTI vulnerabilities are frequently exploited in the wild once technical details emerge.

Impact Assessment

The CVSS v3.1 base score is 7.6 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. This indicates:

• Attack Vector (Network): The vulnerability is exploitable remotely over the network, increasing the potential attacker pool.
• Attack Complexity (Low): No special conditions are required; the attack can be performed reliably.
• Privileges Required (Low): The attacker needs only low-privileged authenticated access, not administrative rights.
• User Interaction (None): No victim action is needed beyond normal application use.
• Scope (Unchanged): The impact is confined to the vulnerable application and its resources.
• Confidentiality (High): Successful exploitation could result in the disclosure of sensitive information, including device credentials, configuration data, and potentially underlying system files.
• Integrity (Low): The attacker may be able to modify limited data, but the primary impact is not integrity.
• Availability (Low): The attack could cause minor disruptions, but not a full denial of service.

The affected products—OpManager, NetFlow Analyzer, and Network Configuration Manager—are widely deployed in enterprise network operations centers (NOCs) to monitor and manage network infrastructure. These applications often store credentials for routers, switches, firewalls, and other critical devices. Compromise of these systems can provide an attacker with a pivot point into the network, enabling lateral movement and further exploitation. The blast radius includes not only the ManageEngine server but also the entire managed network infrastructure, as attackers could extract credentials and use them to access network devices.

Business impact includes potential regulatory violations (e.g., GDPR, HIPAA) if sensitive data is exfiltrated, operational downtime if network management is disrupted, and reputational damage. The lack of a patch (patch confidence 0/4) exacerbates the risk, as organizations cannot rely on vendor-supplied fixes at this time.

Detection Guidance

Sigma Rule

title: Potential ManageEngine Configlet SSTI Exploitation Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential server-side template injection attempts against ManageEngine Configlet processing
author: Threat Intelligence Team
date: 2026-07-15
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - '${'
      - '#{'
      - '<%='
      - '{{'
      - '}}'
      - 'freemarker'
      - 'velocity'
      - 'Runtime.getRuntime'
      - 'ProcessBuilder'
    cs-uri-query|contains|all:
      - 'configlet'
  condition: selection
falsepositives:
  - Legitimate template syntax in configlet content
level: high
tags:
  - attack.t1190
  - cve.2026-12370

YARA Rule

rule CVE_2026_12370_ManageEngine_SSTI_Configlet
{
    meta:
        description = "Detects potential SSTI exploitation attempts targeting ManageEngine Configlet processing"
        author = "Threat Intelligence Team"
        date = "2026-07-15"
        reference = "CVE-2026-12370"
        severity = "high"
    strings:
        $ssti1 = "${" ascii wide nocase
        $ssti2 = "#{" ascii wide nocase
        $ssti3 = "<%=" ascii wide nocase
        $ssti4 = "{{" ascii wide nocase
        $java1 = "Runtime.getRuntime" ascii wide nocase
        $java2 = "ProcessBuilder" ascii wide nocase
        $configlet = "configlet" ascii wide nocase
    condition:
        $configlet and 2 of ($ssti*)
        or
        $configlet and any of ($java*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-12370 ManageEngine Configlet SSTI Exploitation Attempt"; flow:to_server,established; http.uri; content:"configlet"; nocase; http.uri; content:"${"; nocase; http.uri; content:"Runtime"; nocase; classtype:web-application-attack; reference:cve,2026-12370; sid:202612370; rev:1;)

Elastic Detection

network where
  http.request.method == "POST" and
  http.request.uri : "configlet" and
  (
    http.request.body : "${" or
    http.request.body : "#{" or
    http.request.body : "<%=" or
    http.request.body : "Runtime.getRuntime" or
    http.request.body : "ProcessBuilder"
  )

Splunk SPL Query

index=web OR index=proxy
| search (uri="*configlet*" OR url="*configlet*")
| search (uri="*${*" OR uri="*#{*" OR uri="*<%=*" OR uri="*Runtime.getRuntime*" OR uri="*ProcessBuilder*")
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip, uri, status
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100200" level="12">
    <if_sid>31100</if_sid>
    <id>^configlet</id>
    <description>CVE-2026-12370: Potential ManageEngine Configlet SSTI exploitation attempt</description>
    <match>${|#{|<%=|Runtime.getRuntime|ProcessBuilder</match>
    <group>cve_2026_12370,attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source.

1. Immediate mitigations:

   • Restrict network access to ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager instances. Do not expose these services directly to the internet. Use VPNs or zero-trust network access (ZTNA) for remote administration.
   • Enforce strong authentication and least privilege for all accounts. Disable or restrict low-privileged accounts that can access configlet processing functionality.
   • Implement a web application firewall (WAF) with virtual patching rules to detect and block common SSTI payloads (e.g., ${, #{, <%=, {{). Note that WAF bypasses are possible; this is a defense-in-depth measure.
   • Monitor for suspicious template syntax in HTTP requests to configlet endpoints, using the detection rules provided in this report.
   • If configlet processing is not required, disable or remove the feature temporarily.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Monitor Zoho ManageEngine security advisories and the NVD entry for CVE-2026-12370 for updates.
   • Once a patch is released, test it in a staging environment before applying to production. Ensure all three products (OpManager, NetFlow Analyzer, Network Configuration Manager) are updated, as they share the vulnerable component.

3. Long-term hardening:

   • Conduct a security review of all template engine usage in custom and third-party applications. Implement context-aware output encoding and sandboxing for template engines.
   • Adopt a secure software development lifecycle (SDLC) that includes static and dynamic analysis for injection flaws.
   • Regularly rotate credentials for network devices and service accounts to limit the impact of credential exposure.
   • Implement network segmentation to isolate management planes from general user networks.
   • Enable comprehensive logging and monitoring for all management applications, and integrate with a SIEM for correlation and alerting.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-12370
• CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine — https://cwe.mitre.org/data/definitions/1336.html
• Zoho ManageEngine Security Advisories: https://www.manageengine.com/security/advisories/
• OWASP Server-Side Template Injection: https://owasp.org/www-community/attacks/Server-Side_Template_Injection
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or threat actor campaign information is available for CVE-2026-12370 at the time of writing. The vulnerability is not listed in CISA KEV.