External risk intelligence

ManageEngine M365 Manager Plus Privilege Escalation Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-12591

ManageEngine M365 Manager Plus is a web-based management and reporting tool designed to be accessible to technicians for administrative tasks. Because it is frequently deployed as an externally reachable management interface or web portal to facilitate remote administration of Microsoft 365 environments, it is commonly accessible via the network in real-world deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in ManageEngine M365 Manager Plus that could allow an authenticated user to escalate their privileges, potentially leading to remote code execution. The issue stems from insufficient permission validation within the delegated administration interface. While the direct business impact requires further assessment of your specific deployment and usage, this type of vulnerability could, in severe cases, allow unauthorized control over systems.

Authenticated users could gain unauthorized administrative access.
It affects a tool used for managing Microsoft 365.
Confirm if this product is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with technician-level access could leverage a flaw in how permissions are checked within the delegated administration area. By exploiting this insufficient permission validation, they could gain privileges beyond what they should have, potentially leading to the execution of arbitrary code during administrative tasks.

Authenticated technician access is required.
Insufficient permission validation triggers vulnerability.
Risk of privilege escalation and code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated technician could escalate their privileges when using the delegated administration interface. This escalation may allow for remote code execution during administrative processing when supported.

System data and configuration at risk.
Privilege escalation via interface vulnerability.
Remote code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to the teams responsible for managing Microsoft 365 environments and the ManageEngine platform. This could include dedicated M365 administrators, IT infrastructure teams, or security operations teams responsible for the overall security posture. The first practical step is to identify all instances of ManageEngine M365 Manager Plus, assess their network accessibility and business criticality, and then confirm the accountable owner for remediation planning.

M365 administrators and infrastructure teams.
Confirm instance accessibility and business criticality.
Plan remediation considering administrative workflows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ManageEngine M365 Manager Plus?

ManageEngine M365 Manager Plus is a specialized web-based management and reporting solution. IT teams use it to simplify the administration of Microsoft 365 environments, handling tasks like user provisioning, mailbox management, and security auditing from a centralized interface.

What does CVE-2026-12591 mean for this software?

This vulnerability is classified as CWE-862, which is a missing permission check. In this instance, the software fails to properly verify if a user has the right to perform certain actions within the delegated administration interface. This weakness allows an authenticated user to bypass assigned restrictions and perform unauthorized tasks that could lead to code execution.

How is this vulnerability triggered?

An attacker must already have authenticated technician-level access to the application. The issue is triggered specifically within the delegated administration interface when the software fails to validate permissions. General usage of the application by users without technician privileges does not trigger this specific flaw.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because this tool is frequently deployed as an externally reachable web portal to support remote administration, it is often accessible via the network. If your instance is exposed to the internet to facilitate remote access for technicians, it is considered more reachable for this type of attack.

What steps should I take if I use this product?

Start by identifying all deployed instances of ManageEngine M365 Manager Plus within your environment. Once mapped, assess their current network accessibility and overall business criticality. Coordinate with the teams responsible for M365 infrastructure to confirm ownership and plan your path toward the necessary version updates.

References

www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.