CVE-2023-26600

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-06 · updated 2026-06-17
Weakness: CWE-269

Description

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.

Affected products

Manage Engine Asset Explorer Agent: before 6.9; 6.9, 6.9-6900, 6.9-6901, 6.9-6902, 6.9-6903, 6.9-6904 (+31) — fixed in 6.9
ManageEngine ServiceDesk Plus: before 14.1; 14.1, 14.1-14100, 14.1-14101, 14.1-14102, 14.1-14103 — fixed in 14.1
Zohocorp Manageengine Servicedesk Plus Msp: before 13.0; 13.0, 13.0-13000, 13.0-13001, 13.0-13002, 13.0-13003, 13.0-13004 — fixed in 13.0
Zohocorp Manageengine Supportcenter Plus: before 11.0; 11.0, 11.0-11000, 11.0-11001, 11.0-11002, 11.0-11003, 11.0-11004 (+22) — fixed in 11.0

How to fix

Upgrade to a fixed version: Manage Engine Asset Explorer Agent 6.9; ManageEngine ServiceDesk Plus 14.1; Zohocorp Manageengine Servicedesk Plus Msp 13.0; Zohocorp Manageengine Supportcenter Plus 11.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26600 or the next vulnerability affects your stack