CVE-2026-14308 - Vulnerability Details - OpenCVE

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zohocorp	Manageengine Malware Protection Plus

No data.

No data.

References

Link	Providers
https://www.manageengine.com/malware-protection/help/edr/insufficient-driver-signature-kb.html

History

Tue, 13 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.
Title		Insufficient Signature Validation
First Time appeared		Zohocorp Zohocorp manageengine Malware Protection Plus
Weaknesses		CWE-20
CPEs		cpe:2.3:a:zohocorp:manageengine_malware_protection_plus::::::::
Vendors & Products		Zohocorp Zohocorp manageengine Malware Protection Plus
References		https://www.manageengine.com/malware-protection/help/edr/insufficient-driver-signature-kb.html
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2026-10-13T07:51:58.757Z

Updated: 2026-10-13T12:13:32.674Z

Reserved: 2026-07-01T11:22:40.169Z

Link: CVE-2026-14308

Vulnrichment

Updated: 2026-10-13T12:13:29.341Z

NVD

Status : Awaiting Analysis

Published: 2026-10-13T08:17:00.440

Modified: 2026-10-15T20:39:54.150

Link: CVE-2026-14308

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14308", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-07-01T11:22:40.169Z", "datePublished": "2026-10-13T07:51:58.757Z", "dateUpdated": "2026-10-13T12:13:32.674Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-10-13T07:51:58.757Z"}, "title": "Insufficient Signature Validation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine Malware Protection Plus", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.0.64.12", "versionType": "1.0.64.12"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_malware_protection_plus:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "1.0.64.12"}]}]}], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Malware Protection Plus versions\u00a0before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Zohocorp ManageEngine Malware Protection Plus versions <span>before 1.0.64.12 are affected by i</span>nsufficient driver signature validation in MEARWService."}]}], "references": [{"url": "https://www.manageengine.com/malware-protection/help/edr/insufficient-driver-signature-kb.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 4.9, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Jeremy / Holly Sadler", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T12:13:23.771584Z", "id": "CVE-2026-14308", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T12:13:32.674Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T12:13:23.771584Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T12:13:29.341Z"}}], "cna": {"title": "Insufficient Signature Validation", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jeremy / Holly Sadler"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine Malware Protection Plus", "versions": [{"status": "affected", "version": "0", "versionType": "1.0.64.12", "lessThanOrEqual": "1.0.64.12"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/malware-protection/help/edr/insufficient-driver-signature-kb.html"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Malware Protection Plus versions\u00a0before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.", "supportingMedia": [{"type": "text/html", "value": "Zohocorp ManageEngine Malware Protection Plus versions <span>before 1.0.64.12 are affected by i</span>nsufficient driver signature validation in MEARWService.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_malware_protection_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.0.64.12", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-10-13T07:51:58.757Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14308", "state": "PUBLISHED", "dateUpdated": "2026-10-13T12:13:32.674Z", "dateReserved": "2026-07-01T11:22:40.169Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2026-10-13T07:51:58.757Z", "assignerShortName": "Zohocorp"}, "dataVersion": "5.2"}