CVE-2026-77699: ManageEngine Endpoint Central Privilege Escalation

CVE-2026-77699 Overview

CVE-2026-77699 is a local privilege escalation vulnerability in Zohocorp ManageEngine Endpoint Central. Versions below 11.5.2605.01 load a dynamic-link library (DLL) from an untrusted path, allowing a local attacker with low privileges to execute code in a higher-privileged context. The weakness maps to [CWE-269: Improper Privilege Management].

Exploitation requires local access, user interaction, and specific conditions to succeed, which limits opportunistic attacks. However, successful abuse enables an attacker to escalate privileges on affected endpoint management servers.

Critical Impact
A local attacker who places a malicious DLL in a path searched by the vulnerable Endpoint Central process can execute code with elevated privileges, undermining the trust boundary of the endpoint management platform.

Affected Products

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01

Discovery Timeline

2026-09-07 - CVE-2026-77699 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77699

Vulnerability Analysis

The vulnerability stems from insecure DLL loading behavior in ManageEngine Endpoint Central. When a privileged process resolves a DLL name, it searches directories that a low-privileged local user can write to. The process then loads and executes the attacker-supplied library in its own security context.

Because Endpoint Central runs components with elevated privileges to manage endpoints, code executed inside its process inherits those privileges. This turns a file-write primitive in a user-controlled directory into local privilege escalation. The scope change reflected in the CVSS vector indicates that the compromised component impacts resources beyond its own security authority.

Root Cause

The root cause is untrusted search path behavior during library loading. The application does not pin DLL loads to a fully qualified, trusted directory, and does not validate the origin or signature of the loaded module. Any writable directory that appears earlier in the DLL search order than the intended location becomes an injection point.

Attack Vector

An attacker must already have local, low-privileged access to the host running Endpoint Central. The attacker places a crafted DLL with a name matching one the vulnerable process resolves through the insecure search path. When the process or a triggering workflow loads that DLL, the payload runs with the process's elevated privileges. User interaction is required, consistent with the attack complexity described in the advisory. See the ManageEngine Privilege Escalation Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-77699

Indicators of Compromise

Unsigned or unexpected DLLs present in directories writable by non-administrative users on hosts running Endpoint Central.
Endpoint Central processes loading modules from paths outside the standard installation directory.
Child processes spawned by Endpoint Central services running with SYSTEM privileges without a corresponding administrative workflow.

Detection Strategies

Monitor image-load events (Windows Sysmon Event ID 7) for Endpoint Central processes and alert on loads originating from non-standard directories.
Baseline the expected DLLs loaded by Endpoint Central binaries and flag deviations.
Audit file-creation events in directories referenced by the DLL search order for the Endpoint Central process tree.

Monitoring Recommendations

Enable command-line and module-load auditing on servers hosting ManageEngine Endpoint Central.
Forward endpoint telemetry to a centralized analytics platform to correlate DLL loads with subsequent privileged process activity.
Track integrity of the Endpoint Central installation directory and alert on new or modified DLLs.

How to Mitigate CVE-2026-77699

Immediate Actions Required

Upgrade ManageEngine Endpoint Central to version 11.5.2605.01 or later.
Restrict interactive and local logon rights on servers running Endpoint Central to trusted administrators only.
Audit permissions on directories in the DLL search path and remove write access for non-administrative users.

Patch Information

Zohocorp has released a fixed build in ManageEngine Endpoint Central 11.5.2605.01. Apply the vendor update as documented in the ManageEngine Privilege Escalation Advisory.

Workarounds

Enforce application allow-listing to prevent unsigned DLLs from loading into Endpoint Central processes.
Remove non-administrative write permissions from directories that appear in the process DLL search order.
Isolate the Endpoint Central server from general-purpose user workloads until the patch is deployed.

bash

# Configuration example: audit writable directories in the DLL search path on Windows
icacls "C:\Program Files\ManageEngine\DesktopCentral_Server"
icacls "C:\Program Files\ManageEngine\DesktopCentral_Server" /remove:g "Users"