CVE-2026-6516

Executive Summary

CVE-2026-6516 is a Critical severity vulnerability in Zohocorp ManageEngine ADAudit Plus, a widely deployed Active Directory auditing and compliance solution. The flaw allows an unauthenticated, remote attacker to achieve full Remote Code Execution (RCE) by exploiting a vulnerable agent API. With a CVSS score of 10.0, this represents the most severe class of vulnerability, requiring no authentication, no user interaction, and no special network access beyond reachability to the affected service.

The business impact is severe. ManageEngine ADAudit Plus is commonly deployed in enterprise environments to monitor Active Directory changes, often holding privileged service accounts and sensitive audit logs. A successful compromise would grant an attacker a foothold inside the corporate network, potentially leading to lateral movement, credential theft, and full domain compromise. The likely attacker profile includes ransomware operators and nation-state actors seeking initial access to high-value targets.

Despite the CVSS 10.0 score, the EPSS exploitation probability is currently 0.0%, indicating no observed exploitation in the wild as of the publication date. This provides a narrow window for defenders to apply mitigations before weaponized exploits become publicly available. No public proof-of-concept is available as of 2026-07-23.

CVSS Breakdown & Threat Level

Qualitative Severity: Critical

The CVSS 3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H decomposes as follows:

• AV:N (Network): The vulnerable agent API is exposed over the network. An attacker does not require physical or local access.
• AC:L (Low): No special conditions or race conditions are required. The attack complexity is low, meaning the exploit can be reliably executed.
• PR:N (None): The vulnerability requires no authentication. The attacker does not need valid credentials.
• UI:N (None): No user interaction is required. The attack is fully automated.
• S:U (Unchanged): A successful exploit does not change the scope; the compromised component is the vulnerable software itself.
• C:H/I:H/A:H (High/High/High): The vulnerability leads to a complete compromise of confidentiality, integrity, and availability. An attacker can read, modify, or delete any data accessible to the ADAudit Plus service and execute arbitrary code.

EPSS Interpretation: The 0.0% EPSS score indicates that as of the report date, there is no evidence of active exploitation in the wild. This is typical for a newly published CVE. However, given the CVSS 10.0 score and the popularity of ManageEngine products, this is expected to change rapidly once exploit details are reverse-engineered from the patch.

Historical Comparison: This vulnerability is technically similar to CVE-2022-47966 (ManageEngine RCE via SAML) and CVE-2021-44077 (ManageEngine ServiceDesk Plus RCE). Both were unauthenticated RCE flaws in ManageEngine products that were weaponized by ransomware groups (e.g., Cl0p, Vice Society) within weeks of disclosure. The same pattern is expected here.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability resides in the agent API component of ADAudit Plus. The developer failed to properly validate or sanitize input received from the agent communication channel. This allows an unauthenticated attacker to inject serialized objects or command strings that are deserialized or executed by the server without proper authorization checks.

Step-by-Step Attack Flow:

1. Reconnaissance: The attacker identifies a target running ADAudit Plus (versions before 8606) on the default port (typically 8080 or 8443 for HTTPS). Shodan dorks such as product:ManageEngine ADAudit Plus can be used.
2. Direct API Call: The attacker crafts a malicious HTTP/HTTPS request to the vulnerable agent API endpoint. The exact endpoint is not publicly documented, but based on the vulnerability class, it is likely a path such as /agent/, /api/agent/, or a similar unauthenticated handler.
3. Payload Delivery: The request contains a serialized Java object or a command string within a parameter (e.g., cmd, action, data). Because the API does not enforce authentication, the server processes the request.
4. Deserialization/Execution: The server deserializes the malicious object or executes the injected command, leading to arbitrary code execution in the context of the ADAudit Plus service (typically SYSTEM or NETWORK SERVICE on Windows).
5. Post-Exploitation: The attacker can deploy a web shell, establish a reverse shell, or execute arbitrary commands to move laterally within the network.

Attack Surface: The vulnerable agent API is exposed on the same network interface as the main web application. It does not require authentication, making it accessible to any attacker who can reach the server on the relevant port.

Why Standard Defenses May Fail: Traditional Web Application Firewalls (WAFs) may not have signatures for this specific API endpoint or payload pattern. Network segmentation is often insufficient because ADAudit Plus is frequently placed in a DMZ or directly accessible to domain-joined systems. Endpoint Detection and Response (EDR) may catch the post-exploitation activity, but the initial injection may bypass detection if the payload is obfuscated.

Vulnerable vs. Patched Code Analysis

Since no patch code or commit is publicly available, the following is a representative analysis based on the vulnerability class (CWE-94: Improper Control of Generation of Code).

Vulnerable Code (Pseudocode):

// Vulnerable: No authentication check, no input validation
@POST
@Path("/agent/execute")
public Response executeAgentCommand(String command) {
    // Directly executes the command without validation
    Process process = Runtime.getRuntime().exec(command);
    // ... process output
}

Patched Code (Pseudocode):

// Patched: Authentication check and input sanitization added
@POST
@Path("/agent/execute")
public Response executeAgentCommand(@Context HttpHeaders headers, String command) {
    // 1. Authentication check
    if (!isAuthenticatedAgent(headers)) {
        return Response.status(401).build();
    }
    // 2. Input validation: whitelist allowed commands
    if (!isAllowedCommand(command)) {
        return Response.status(400).build();
    }
    // 3. Safe execution with parameterized commands
    Process process = Runtime.getRuntime().exec(sanitizeCommand(command));
    // ... process output
}

What the Patch Changes: The patch introduces two critical controls:

1. Authentication Enforcement: The agent API now requires a valid authentication token or certificate before processing requests.
2. Input Validation: The command input is validated against a whitelist of allowed operations, preventing arbitrary command injection.

Regression Considerations: Teams applying the patch should verify that legitimate agent-to-server communication still functions correctly. The authentication mechanism may require updating agent configurations or certificates.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-23T17:22:26.627Z
• Estimated Discovery: The vulnerability was likely discovered internally by Zohocorp or reported through a bug bounty program. The exact discovery date is unknown.
• Disclosure Process: Zohocorp (the CNA) coordinated the disclosure. The CVE was published on the same day as the fix (version 8606) was released.
• Known Exploitation: No known active exploitation as of 2026-07-23.
• CISA KEV: Not listed as of the report date.

Threat Intelligence Context

Threat Actor Profile: Unauthenticated RCE vulnerabilities in enterprise management software are a prime target for:

• Ransomware Operators: Groups like Cl0p, LockBit, and BlackCat have historically weaponized ManageEngine vulnerabilities for initial access.
• Nation-State Actors: APT groups (e.g., APT29, APT41) target such software for persistent access to government and defense networks.
• Initial Access Brokers: These actors sell access to compromised networks on underground forums.

Attack Campaign Context: This vulnerability is likely to be incorporated into automated scanning tools (e.g., Nuclei, Metasploit) within weeks. It may be used in conjunction with other vulnerabilities for lateral movement.

Industry Verticals Most at Risk: Financial services, healthcare, government, and any organization using Active Directory for identity management. ADAudit Plus is often deployed in regulated industries for compliance auditing.

Geographic Targeting: No specific geographic pattern is known, but ManageEngine has a global customer base, making this a universal threat.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Windows Server 2019/2022 VM with ADAudit Plus version 8605 (or earlier) installed.
2. Network: The VM should be on an isolated network segment with port 8080 (or the configured port) accessible from the attacker machine.
3. Attacker Machine: Kali Linux or any system with curl, nc, and a scripting language (Python, Go).

Prerequisites:

• ADAudit Plus version < 8606.
• Network access to the ADAudit Plus web interface.

Exploitation Walkthrough (Illustrative):

Since no public PoC exists, the following is a representative attack flow based on the vulnerability class.

1. Identify the vulnerable endpoint:

   curl -v http://target:8080/agent/status
   

   If the endpoint returns a response without authentication, it is likely vulnerable.

2. Craft the malicious payload: The payload would be a serialized Java object or a command string. For example, using a tool like ysoserial to generate a CommonsCollections gadget chain:

   java -jar ysoserial.jar CommonsCollections5 'cmd.exe /c powershell -enc <BASE64_ENCODED_PAYLOAD>' > payload.ser
   

3. Send the exploit:

   curl -X POST http://target:8080/agent/execute --data-binary @payload.ser -H "Content-Type: application/octet-stream"
   

4. Expected Output: The server executes the command. A reverse shell or web shell is deployed.

Post-Exploitation:

• Dump Active Directory hashes using tools like Mimikatz.
• Extract service account credentials from the ADAudit Plus configuration files.
• Use the compromised host as a pivot point for lateral movement.

Blue Team Section

Detection:

• Monitor for unusual HTTP POST requests to /agent/ or /api/agent/ paths.
• Alert on large binary payloads in POST requests to these endpoints.
• Monitor for process creation events where java.exe or javaw.exe spawns cmd.exe, powershell.exe, or wscript.exe.

Log Entries:

• Web server logs showing POST /agent/execute with a 200 response code from an unexpected source IP.
• Windows Event ID 4688 (Process Creation) showing cmd.exe or powershell.exe spawned by java.exe.

Network Traffic Signatures:

• Outbound connections from the ADAudit Plus server to unknown IP addresses on ports 80, 443, or 4444 (common reverse shell ports).
• Unusual DNS queries from the ADAudit Plus server.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• HTTP POST requests to /agent/execute or similar paths.
• Requests with Content-Type: application/octet-stream or Content-Type: application/x-java-serialized-object.
• Source IPs not matching known agent subnets.

HTTP Request Patterns:

POST /agent/execute HTTP/1.1
Host: target:8080
Content-Type: application/octet-stream
Content-Length: [large number]

[Binary data - serialized Java object]

File System Artifacts:

• Unexpected files in the ADAudit Plus installation directory (e.g., C:\Program Files\ManageEngine\ADAudit Plus\webapps\).
• Web shells with extensions like .jsp, .asp, or .aspx.

Process Execution Anomalies:

• java.exe spawning cmd.exe or powershell.exe.
• Network connections from java.exe to external IPs.

Log Entries:

• Windows Event ID 4688: Process Creation: java.exe -> cmd.exe.
• ADAudit Plus application logs showing errors in the agent API handler.

Detection Engineering

YARA Rule

rule CVE-2026-6516_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-6516 in Zohocorp ManageEngine ADAudit Plus"
        author = "Valters IT Hub"
        date = "2026-07-23"
        reference = "https://www.valtersit.com/cve/cve-2026-6516"
    strings:
        $agent_path = "/agent/execute"
        $java_serial = { AC ED 00 05 }  // Java serialization magic bytes
        $cmd_exec = "cmd.exe" nocase
    condition:
        $agent_path and ($java_serial or $cmd_exec)
}

Sigma Rule (SIEM)

title: CVE-2026-6516 Zohocorp ManageEngine ADAudit Plus Exploitation Detection
id: 73cb4e0d-622a-4d5b-9bc1-4866452f4c0d
status: experimental
description: Detects exploitation attempts targeting CVE-2026-6516 in Zohocorp ManageEngine ADAudit Plus
author: Valters IT Hub
date: 2026-07-23
references:
    - https://www.valtersit.com/cve/cve-2026-6516
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/agent/execute'
    condition: selection
falsepositives:
    - Legitimate agent communication if the endpoint is used for authorized updates
level: high

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-6516 - ManageEngine ADAudit Plus Agent API Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/agent/execute"; http_uri; content:"|ac ed 00 05|"; within:4; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic (EQL) Query

sequence by process.entity_id
  [process where event.type == "start" and process.name == "java.exe"]
  [process where event.type == "start" and (process.name == "cmd.exe" or process.name == "powershell.exe")]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search ParentProcessName="*java.exe" (NewProcessName="*cmd.exe" OR NewProcessName="*powershell.exe")
| stats count by host, ParentProcessName, NewProcessName, AccountName

Wazuh Rule

<rule id="100001" level="12">
  <if_sid>4688</if_sid>
  <field name="win.eventdata.parentProcessName">java.exe</field>
  <field name="win.eventdata.processName">cmd.exe|powershell.exe</field>
  <description>CVE-2026-6516: Potential RCE via ManageEngine ADAudit Plus</description>
  <group>cve-2026-6516,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Apply the Patch: Upgrade ADAudit Plus to version 8606 or later immediately.
   • Download the latest version from the Zohocorp ManageEngine portal.
   • Run the installer as an administrator.
2. Network-Level Mitigation (if patching is delayed):
   • Restrict access to the ADAudit Plus web interface to trusted IP addresses only using a firewall or network ACL.
   • Block HTTP POST requests to /agent/ paths at the perimeter firewall or WAF.
3. Authentication Hardening:
   • If the agent API is not required, disable it in the configuration.
   • Ensure the ADAudit Plus service account has minimal privileges.

Short-term (1-7 days)

1. Configuration Hardening:
   • Review and restrict network access to the ADAudit Plus server.
   • Enable HTTPS with a valid certificate to encrypt traffic.
2. Monitoring Implementation:
   • Deploy the detection rules provided in this report.
   • Enable detailed logging for the web server and Windows Event Logs.
3. Vulnerability Scanning:
   • Run a vulnerability scanner (e.g., Nessus, Qualys) to confirm the patch has been applied.
   • Command to check version: Get-ItemProperty "HKLM:\SOFTWARE\ManageEngine\ADAudit Plus" | Select-Object Version

Long-term

1. Architecture Changes:
   • Place ADAudit Plus behind a reverse proxy (e.g., Nginx, Apache) with strict access controls.
   • Implement network segmentation to isolate the ADAudit Plus server from the rest of the domain.
2. Security Control Improvements:
   • Deploy an EDR solution on all servers.
   • Implement application whitelisting to prevent unauthorized executables.
3. Developer Training:
   • Ensure development teams are trained on secure coding practices, particularly around input validation and authentication.

Validation

To confirm the patch was applied:

1. Log in to the ADAudit Plus web interface.
2. Navigate to Admin -> Build Information.
3. Verify the build number is 8606 or higher.
4. Alternatively, check the registry key: HKLM:\SOFTWARE\ManageEngine\ADAudit Plus\Version.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-6516
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-6516
• Vendor advisory: See vendor security page at https://www.manageengine.com/security/advisory/
• OSV: https://osv.dev/vulnerability/CVE-2026-6516
• Related CWE: https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-23 | https://www.valtersit.com/cve/cve-2026-6516