CVE-2026-19599: ManageEngine OpManager MSP RCE Vulnerability

CVE-2026-19599 Overview

ZohoCorp ManageEngine OpManager MSP contains a remote code execution vulnerability in the Notification Profile module. The flaw affects versions 12.8.709 and earlier. Attackers with low-privilege authenticated access can execute arbitrary operating system commands on the underlying host. The weakness is classified as OS Command Injection [CWE-78]. Successful exploitation compromises the confidentiality, integrity, and availability of the monitoring server and any downstream managed service provider (MSP) infrastructure it reaches.

Critical Impact
An authenticated attacker can inject operating system commands through the Notification Profile module, achieving code execution on ManageEngine OpManager MSP servers and pivoting into managed customer environments.

Affected Products

ZohoCorp ManageEngine OpManager MSP version 12.8.709
ZohoCorp ManageEngine OpManager MSP prior versions in the 12.x branch
Deployments exposing the Notification Profile module to authenticated users

Discovery Timeline

2026-09-23 - CVE-2026-19599 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-19599

Vulnerability Analysis

The vulnerability resides in the Notification Profile module of ManageEngine OpManager MSP. This module lets administrators define automated actions triggered by monitoring events, including script or command execution on the OpManager server. Input passed to the notification handler is not sanitized before being passed to an operating system shell. An authenticated attacker with permission to create or modify notification profiles can embed shell metacharacters that the server executes with the privileges of the OpManager process. Because OpManager MSP is designed to manage remote customer networks, code execution on the central console can expose credentials, API keys, and remote-management channels for every tenant.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The Notification Profile handler concatenates user-controlled fields into a command string that is passed to a system shell without escaping metacharacters such as ;, |, backticks, and $(). The scope change reflected in the CVSS vector indicates that the vulnerable component executes commands in a security context beyond its own, amplifying the blast radius.

Attack Vector

Exploitation requires network access to the OpManager MSP web interface and a valid low-privilege account with rights to the Notification Profile feature. The attacker crafts a notification action containing injected shell syntax. When the notification is triggered, either by a real event or by a test invocation, the server executes the injected commands. No user interaction is required beyond the attacker's own actions.

No public proof-of-concept exploit code is available. Refer to the ManageEngine Security Advisory CVE-2026-19599 for vendor-supplied technical details.

Detection Methods for CVE-2026-19599

Indicators of Compromise

Notification Profile entries containing shell metacharacters such as ;, &&, |, backticks, or $() in command or argument fields
Unexpected child processes spawned by the OpManager Java process, including cmd.exe, powershell.exe, /bin/sh, /bin/bash, or curl
Outbound network connections from the OpManager MSP host to unfamiliar IP addresses following notification events
New or modified files under OpManager installation directories with recent timestamps that do not correspond to a vendor update

Detection Strategies

Audit the Notification Profile configuration table in the OpManager MSP database for entries created or modified by non-administrative accounts
Correlate authenticated web sessions targeting the notification profile endpoints with subsequent process-creation events on the host
Alert on any OpManager service account executing interactive shells, scripting hosts, or reconnaissance binaries such as whoami, net, or id

Monitoring Recommendations

Forward OpManager application logs and host process telemetry to a centralized SIEM for correlation across MSP tenants
Enable command-line auditing on Windows (Process Creation with command line) or auditdexecve logging on Linux OpManager hosts
Monitor administrative logins to the OpManager MSP console and flag notification profile changes outside approved change windows

How to Mitigate CVE-2026-19599

Immediate Actions Required

Upgrade ManageEngine OpManager MSP to a fixed build above 12.8.709 as identified in the vendor advisory
Restrict access to the OpManager MSP web console to trusted management networks and enforce multi-factor authentication for all operator accounts
Review Notification Profile entries and remove any unexpected commands, scripts, or arguments introduced since the last known-good backup
Rotate credentials, API tokens, and SNMP or WMI secrets stored within OpManager if compromise cannot be ruled out

Patch Information

ZohoCorp has released a fixed build for ManageEngine OpManager MSP. Apply the update referenced in the ManageEngine Security Advisory CVE-2026-19599. MSP operators should patch the central OpManager server first, then validate that customer probes and integrations reconnect correctly.

Workarounds

Limit Notification Profile creation and modification rights to a small set of vetted administrators until the patch is applied
Place the OpManager MSP web interface behind a VPN or reverse proxy that enforces source IP allow-listing
Disable or remove notification profiles that invoke system commands or external scripts if they are not operationally required

bash

# Example: restrict inbound access to the OpManager MSP console using iptables
iptables -A INPUT -p tcp --dport 8060 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8060 -j DROP