CVE-2026-84791 Overview
CVE-2026-84791 is a Broken Access Control vulnerability [CWE-639] affecting ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below. An authenticated low-privilege user can modify Change Management report schedule configurations for firewalls outside their assigned scope. The flaw stems from insufficient authorization enforcement on scheduled report configuration endpoints. Successful exploitation allows tampering with reporting data for firewall devices that the attacker should not access. This weakens operational integrity and can undermine change auditing and compliance workflows across the monitored firewall estate.
Critical Impact
An authenticated low-privilege user can alter Change Management report schedules for firewalls outside their authorized scope, compromising monitoring integrity.
Affected Products
- ZohoCorp ManageEngine OpManager versions 12.8.710 and below
- ZohoCorp ManageEngine Firewall Analyzer versions 12.8.710 and below
Discovery Timeline
- 2026-09-23 - CVE CVE-2026-84791 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-84791
Vulnerability Analysis
The vulnerability resides in the Change Management report scheduling functionality of ManageEngine OpManager and Firewall Analyzer. The application authenticates users but fails to verify whether the requested firewall device falls within the user's assigned scope. This is a classic authorization control gap where identity is validated but object-level permissions are not enforced.
An authenticated attacker with only low privileges can issue requests referencing firewall identifiers that belong to other scopes. The backend accepts and applies the configuration change without validating scope boundaries. This enables horizontal privilege escalation across the tenant or scope model used by the platform.
The impact is limited to configuration integrity of report schedules and does not expose confidential data at rest or disable the platform. However, tampered report schedules can suppress or distort change tracking for firewalls that the attacker cannot otherwise administer.
Root Cause
The root cause is missing object-level authorization on the report schedule modification handler. The application relies on the user's authenticated session without validating that the target firewall identifier belongs to the caller's assigned scope. This maps directly to [CWE-639: Authorization Bypass Through User-Controlled Key].
Attack Vector
Exploitation requires network access to the OpManager or Firewall Analyzer web interface and valid low-privilege credentials. The attacker submits a crafted request to the Change Management report scheduling endpoint, substituting the target firewall identifier with one outside their scope. No user interaction is required. See the ManageEngine Security Advisory CVE-2026-84791 for vendor technical details.
Detection Methods for CVE-2026-84791
Indicators of Compromise
- Unexpected modifications to Change Management report schedules for firewalls not typically administered by the acting user account.
- Report schedule configuration changes originating from low-privilege user sessions targeting firewall device identifiers outside their assigned scope.
- Audit log entries showing scope boundary crossings between the authenticated user and the affected firewall resource.
Detection Strategies
- Correlate application audit logs with the user-to-firewall scope mapping to flag configuration writes that cross scope boundaries.
- Alert on Change Management report schedule modifications performed by accounts without administrative role assignments.
- Review historical schedule modification events to identify retrospective abuse prior to patching.
Monitoring Recommendations
- Enable verbose audit logging on ManageEngine OpManager and Firewall Analyzer for all configuration changes affecting report schedules.
- Forward application and web server logs to a centralized SIEM for correlation and long-term retention.
- Monitor authentication events for low-privilege accounts exhibiting unusual configuration activity against firewall assets.
How to Mitigate CVE-2026-84791
Immediate Actions Required
- Upgrade ManageEngine OpManager and Firewall Analyzer to the fixed build published by ZohoCorp above version 12.8.710.
- Audit existing Change Management report schedules and revert unauthorized modifications identified through log review.
- Review and tighten user role assignments to enforce least privilege across firewall scopes.
Patch Information
ZohoCorp has issued a fix addressed in the vendor advisory. Refer to the ManageEngine Security Advisory CVE-2026-84791 for the fixed build number and upgrade instructions applicable to both OpManager and Firewall Analyzer deployments.
Workarounds
- Restrict access to the OpManager and Firewall Analyzer web console to trusted administrative networks until patching is complete.
- Temporarily reduce the number of low-privilege accounts with access to Change Management functionality.
- Increase audit review frequency for report schedule configuration changes until the fixed version is deployed.
# Configuration example
# Verify installed ManageEngine build version
grep -i "build" /opt/ManageEngine/OpManager/conf/product.conf
# Restrict console access at the network layer (example iptables rule)
iptables -A INPUT -p tcp --dport 8060 -s <trusted_admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8060 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
