CVE-2026-77697: ManageEngine Endpoint Central Privilege Escalation

CVE-2026-77697 Overview

CVE-2026-77697 is a privilege escalation vulnerability affecting Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23. The flaw occurs during Java Archive (JAR) extraction and allows a local, authenticated user to elevate privileges on the host system. The weakness is categorized under [CWE-269] Improper Privilege Management. Zohocorp has published a vendor advisory and released a fixed build to address the issue.

Critical Impact
A local attacker with low privileges can escalate rights during JAR extraction, gaining broader access to Endpoint Central components and managed endpoint data.

Affected Products

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23
Deployments performing JAR extraction operations on affected builds
Windows hosts running vulnerable Endpoint Central agents or server components

Discovery Timeline

2026-09-07 - CVE-2026-77697 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77697

Vulnerability Analysis

The vulnerability resides in the JAR extraction workflow used by ManageEngine Endpoint Central. During extraction, the software handles files or directories with insufficient privilege boundaries. A local user with limited access on the host can influence the extraction process to obtain elevated privileges. The scope is changed, meaning the successful exploit affects resources beyond the vulnerable component's security authority. Confidentiality, integrity, and availability are each impacted at a limited level.

Because Endpoint Central manages large fleets of endpoints, privilege elevation on the management host can cascade into broader operational risk. The vendor advisory confirms the issue is resolved in build 11.4.2540.23 and later.

Root Cause

The root cause is improper privilege management [CWE-269] during JAR file extraction. The extraction routine does not correctly enforce the privilege level of the invoking user against files, paths, or permissions produced by the operation. This allows privileges to leak from a higher-context process to a lower-privileged actor. The vendor has not published the exact code path, but the advisory attributes the flaw to the extraction workflow itself.

Attack Vector

Exploitation requires local access and low-level authentication on the affected host. No user interaction is needed. An attacker with an existing foothold, such as a standard user account on a system running Endpoint Central, can trigger or influence a JAR extraction operation to gain elevated privileges. The attack does not traverse the network, which limits mass exploitation but keeps the vulnerability relevant to post-compromise scenarios.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the ManageEngine Privilege Escalation Advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-77697

Indicators of Compromise

Unexpected file writes or permission changes in ManageEngine Endpoint Central installation directories during or after JAR extraction events
New or modified files owned by the Endpoint Central service account created by low-privileged user processes
Anomalous child processes spawned by Endpoint Central components under a local user context

Detection Strategies

Inventory all Endpoint Central deployments and flag any build below 11.4.2540.23 as vulnerable
Monitor process trees where local user processes interact with Endpoint Central service binaries during JAR extraction
Correlate file system events on the Endpoint Central install path with account context to identify privilege boundary violations

Monitoring Recommendations

Enable file integrity monitoring on the Endpoint Central installation directory and its subfolders
Forward Windows security and Sysmon logs from Endpoint Central servers to a centralized SIEM for behavioral analysis
Alert on privilege token elevation events tied to Endpoint Central service processes

How to Mitigate CVE-2026-77697

Immediate Actions Required

Upgrade ManageEngine Endpoint Central to build 11.4.2540.23 or later on all servers and agents
Restrict local interactive logon on Endpoint Central management hosts to administrators only
Audit local accounts on affected hosts and remove unnecessary standard user access

Patch Information

Zohocorp has released a fixed version of ManageEngine Endpoint Central. Administrators should upgrade to build 11.4.2540.23 or later. Patch details, download links, and validation guidance are published in the ManageEngine Privilege Escalation Advisory. Verify the installed build after upgrade using the Endpoint Central console or the on-disk version metadata.

Workarounds

Where immediate patching is not possible, limit local logon rights on Endpoint Central hosts to trusted administrators
Enforce least privilege on service accounts used by Endpoint Central to reduce blast radius during exploitation attempts
Isolate Endpoint Central management hosts on a restricted administrative network segment

bash

# Configuration example: verify installed Endpoint Central build on Windows
reg query "HKLM\SOFTWARE\Wow6432Node\ZOHO Corp\ManageEngine DesktopCentral Server" /v BuildNumber

# Restrict local logon to administrators only via secedit template
secedit /export /cfg current.cfg
# Edit SeInteractiveLogonRight to include only *S-1-5-32-544 (Administrators)
secedit /configure /db secedit.sdb /cfg current.cfg /overwrite