External risk intelligence

ManageEngine OpManager RCE via Notification Profile

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-19599

ManageEngine OpManager is a network management and monitoring solution commonly deployed as a centralized, internet-accessible or perimeter-facing application to manage distributed infrastructure, making its web-based management interface and modules frequent targets for external exposure.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical remote code execution vulnerability has been identified in ZohoCorp ManageEngine OpManager MSP software, potentially allowing unauthorized access and control over affected systems. This issue underscores the importance of maintaining robust security for network management tools that are often central to operational infrastructure. The main concern is confirming relevance and exposure within the organization's deployed ManageEngine products.

Unauthenticated attackers could gain system control.
Centralized network management systems are high-value targets.
Confirm OpManager MSP use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the Notification Profile module in ManageEngine OpManager MSP by exploiting its network exposure. This module, when accessible, allows for potential manipulation that could lead to remote code execution. This could significantly compromise the affected system's integrity and availability.

Requires authenticated access.
Triggered via the Notification Profile module.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a critical vulnerability in the Notification Profile module of ZohoCorp ManageEngine OpManager MSP could allow an unauthenticated attacker to execute arbitrary code remotely. This could affect the availability and integrity of the network monitoring service.

System data and service integrity.
Remote code execution.
Service disruption and compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ZohoCorp ManageEngine OpManager MSP vulnerability in the Notification Profile module requires immediate attention from teams managing the application and its underlying infrastructure. The first practical step is to identify all instances of OpManager MSP, determine their exposure (especially if internet-facing), confirm business criticality, and assign ownership to a specific team for remediation planning.

Application owners must address the issue.
Verify OpManager MSP instances and their reachability.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ZohoCorp ManageEngine OpManager MSP?

ManageEngine OpManager MSP is a comprehensive network management and monitoring platform designed for managed service providers. It acts as a centralized console to monitor the performance, availability, and health of diverse IT infrastructure, including servers, switches, and routers, across multiple customer environments.

What does CWE-78 mean for CVE-2026-19599?

CWE-78 refers to Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. In the context of this vulnerability, it means the software fails to properly sanitize user input within its Notification Profile module, allowing an attacker to inject and execute unauthorized operating system commands with the privileges of the application.

How is the Notification Profile module triggered?

An attacker triggers this vulnerability by interacting with the Notification Profile module in a way that executes arbitrary code. The flaw requires authenticated access to the system to initiate the request, meaning it is not triggered by simple, unauthenticated network traffic hitting the login page or general web interface without valid credentials.

Is my instance of OpManager MSP at risk?

According to Halo Surface Signal, OpManager is typically deployed as a centralized, internet-accessible application to manage distributed infrastructure. Because it is often positioned at the network perimeter, any instance reachable from the internet has a high likelihood of being exposed to this threat compared to systems restricted to internal-only networks.

When should I prioritize fixing this vulnerability?

You should prioritize this immediately if you run ManageEngine OpManager MSP versions 12.8.709 or below. Start by auditing your inventory to locate every instance of the software. Once identified, confirm which instances are internet-facing and verify their current version number to determine if they fall within the affected range, then assign an owner to manage the patching process.

References

www.manageengine.com/itom/advisory/cve-2026-19599.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.