CVE-2026-76980 - Vulnerability Details - OpenCVE

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zohocorp	Manageengine Firewall Analyzer Manageengine Opmanager

No data.

No data.

References

Link	Providers
https://www.manageengine.com/itom/advisory/cve-2026-76980.html

History

Wed, 23 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 23 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
Title		Data Exposure vulnerability
First Time appeared		Zohocorp Zohocorp manageengine Firewall Analyzer Zohocorp manageengine Opmanager
Weaknesses		CWE-20
CPEs		cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:::::::: cpe:2.3:a:zohocorp:manageengine_opmanager::::::::
Vendors & Products		Zohocorp Zohocorp manageengine Firewall Analyzer Zohocorp manageengine Opmanager
References		https://www.manageengine.com/itom/advisory/cve-2026-76980.html
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2026-09-23T12:08:24.566Z

Updated: 2026-09-23T12:38:47.861Z

Reserved: 2026-08-20T06:01:24.559Z

Link: CVE-2026-76980

Vulnrichment

Updated: 2026-09-23T12:38:43.341Z

NVD

Status : Awaiting Analysis

Published: 2026-09-23T13:17:29.393

Modified: 2026-09-23T18:17:31.543

Link: CVE-2026-76980

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76980", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-08-20T06:01:24.559Z", "datePublished": "2026-09-23T12:08:24.566Z", "dateUpdated": "2026-09-23T12:38:47.861Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-09-23T12:08:24.566Z"}, "title": "Data Exposure vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-157", "descriptions": [{"lang": "en", "value": "CAPEC-157 Sniffing Attacks"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine OpManager", "versions": [{"status": "affected", "version": "0", "lessThan": "12.8.710", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zohocorp", "product": "ManageEngine Firewall Analyzer", "versions": [{"status": "affected", "version": "0", "lessThan": "12.8.710", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "12.8.710"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "12.8.710"}]}]}], "descriptions": [{"lang": "en", "value": "ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector."}]}], "references": [{"url": "https://www.manageengine.com/itom/advisory/cve-2026-76980.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T12:38:35.264539Z", "id": "CVE-2026-76980", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T12:38:47.861Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T12:38:35.264539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T12:38:43.341Z"}}], "cna": {"title": "Data Exposure vulnerability", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-157", "descriptions": [{"lang": "en", "value": "CAPEC-157 Sniffing Attacks"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine OpManager", "versions": [{"status": "affected", "version": "0", "lessThan": "12.8.710", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zohocorp", "product": "ManageEngine Firewall Analyzer", "versions": [{"status": "affected", "version": "0", "lessThan": "12.8.710", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/itom/advisory/cve-2026-76980.html"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.", "supportingMedia": [{"type": "text/html", "value": "ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.8.710", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.8.710", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-09-23T12:08:24.566Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76980", "state": "PUBLISHED", "dateUpdated": "2026-09-23T12:38:47.861Z", "dateReserved": "2026-08-20T06:01:24.559Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2026-09-23T12:08:24.566Z", "assignerShortName": "Zohocorp"}, "dataVersion": "5.2"}