CVE-2024-36036: Insufficient Access Control Vulnerability

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-27 · updated 2026-06-17
Weakness: CWE-862

Description

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration.

Affected products

ManageEngine ADAudit Plus: before 7.2; 7.2-7200, 7.2-7201, 7.2-7202, 7.2-7203, 7.2-7210, 7.2-7211 (+7) — fixed in 7.2

How to fix

Upgrade to a fixed version: ManageEngine ADAudit Plus 7.2. Check the vendor advisory for mitigations.

References

https://www.manageengine.com/products/active-directory-audit/cve-2024-36036.html
https://www.manageengine.com/products/active-directory-audit/cve-2024-36036.html

Get alerted when CVE-2024-36036 or the next vulnerability affects your stack