Threat reportVulnerabilityTL-2026-1756

CVE-2026-6516: Unauthenticated Remote Code Execution in ManageEngine ADAudit Plus (CVSS 10.0)

criticalACTIVE

CVE-2026-6516 (TL-2026-1756) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-29. It has no confirmed attribution, affects Zohocorp ManageEngine ADAudit Plus (server), references 3 CVEs (CVE-2026-6516, CVE-2022-28219, CVE-2026-12062), maps to 18 MITRE ATT&CK techniques (T1003, T1005, T1020), and is covered by 9 detection rules and 27 indicators of compromise.

CVSS
10/10Critical
CVEs
3Referenced vulnerabilities
Techniques
18MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
27Indicators of compromise

Key facts for TL-2026-1756

Threat ID
TL-2026-1756
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, financial-services, health, critical-infrastructure, education, technology, professional-services, manufacturing
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in CVE-2026-6516

Malware and tooling: Horizon3.ai NodeZero Rapid Response, Responder / ntlmrelayx, ysoserial (CommonsBeanutils1 gadget chain)

How CVE-2026-6516 works

A critical pre-authentication vulnerability chain in ManageEngine ADAudit Plus Agent APIs lets an unauthenticated network attacker combine authentication bypass with path traversal to write files outside their intended directory and achieve remote code execution. Fixed silently in build 8606 (released 2026-04-17); publicly disclosed by the vendor on 2026-07-23, added to NVD on 2026-07-24 (CWE-78, CVSS 10.0), and followed by a Horizon3.ai NodeZero Rapid Response exploit-validation test on 2026-07-28 — no confirmed in-the-wild exploitation as of publication.

CVE-2026-6516 affects Zohocorp ManageEngine ADAudit Plus, an on-premises Active Directory change-auditing and compliance tool, in all builds prior to 8606. According to the vendor advisory, "vulnerabilities in ADAudit Plus Agent APIs could allow authentication bypass and path traversal," and "an unauthenticated adversary could combine these vulnerabilities to potentially achieve remote code execution" by writing files outside their intended directory. NVD assigns CWE-78 (Improper Neutralization of Special Elements used in an OS Command) as the underlying root-cause weakness class, and rates the flaw CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) — a network-reachable, low-complexity, zero-privilege, zero-interaction exploit with a scope change and high confidentiality/integrity impact. NVD's CVSS breakdown lists an Exploitability sub-score of 3.9 and Impact sub-score of 6.0; the CVE identifier itself was reserved on 2026-04-17, the same day build 8606 shipped, and the record remained in "Awaiting Analysis" status as of the 2026-07-24 NVD update.

The vendor's remediation guidance requires updating the ADAudit Plus server to build 8606 and separately upgrading Windows agents to build 7060 or later, and macOS agents to their latest release regardless of current version. Notably, the required Windows agent minimum (build 7060) is the exact build that fixed the prior related flaw, CVE-2022-28219 (an unauthenticated XXE + Java deserialization + path traversal chain in the same ADAudit Plus Agent API surface, patched 2022-03-30 and documented by Horizon3.ai under the title "Unauthenticated XXE to RCE and Domain Compromise"). Horizon3.ai's 2022 disclosure documents the exact mechanics of that recurrence-prone attack surface: a first-stage XXE injection against the unauthenticated `/api/agent/tabs/agentData` endpoint (vulnerable `ProcessTrackingListener` class using Java's default, externally-resolving `DocumentBuilderFactory`), used to abuse a JAR-protocol blocking-server trick to cache an attacker-supplied serialized Java payload; a second-stage path-traversal request against the `/cewolf/` charting endpoint (`img` parameter, `.png` extension bypass) that triggers untrusted deserialization of the cached payload via the vulnerable third-party Cewolf `FileStorage` class, using a `ysoserial` `CommonsBeanutils1` gadget chain for code execution. Post-exploitation in that 2022 chain included forced NTLM authentication (the XXE-triggered Java HTTP client authenticates outbound), enabling hash capture/relay with Responder and ntlmrelayx, plus direct extraction of encrypted, often domain-admin-privileged Active Directory credentials stored in the ADAudit Plus database — leading to full domain compromise. This strongly suggests CVE-2026-6516 is a recurrence of the same architectural weakness — unauthenticated agent-to-server upload/report endpoints that trust attacker-influenced file paths — rather than an entirely new code path, though the vendor has not disclosed the specific vulnerable endpoint(s) or a full technical root-cause writeup for the 2026 flaw, and Horizon3.ai's 2026 Attack Research entry likewise stops at the vendor's own two-stage (auth bypass + path traversal) description without new endpoint or payload detail.

No PoC exploit code has been published publicly (no GitHub repository, Metasploit module, or exploit-database entry was found), and the flaw is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Horizon3.ai's Attack Research team published an entry for the CVE on 2026-07-28 and released a NodeZero Rapid Response test — a validated, working exploit-chain test used to prove real-world exploitability to Horizon3.ai customers — five days after the public advisory. This closes the gap between disclosure and a demonstrated-working exploit chain to under a week, substantially raising near-term mass-exploitation risk given ADAudit Plus's typical deployment as a privileged, domain-integrated auditing tool with likely internet- or intranet-wide reachability at many organizations.

ADAudit Plus build 8606 was not a single-issue release: ManageEngine's release notes credit a researcher ("Gus 616") with a concurrently-fixed set of Cross-Site Request Forgery vulnerabilities in the Mail settings and SSO/SAML configuration modules, shipped in the same build as the CVE-2026-6516 fix. Two months later, build 8703 (2026-06-12) fixed two further, unrelated ADAudit Plus vulnerabilities — SQL injection (CVE-2026-12062) and account takeover (CVE-2026-11374) — indicating sustained, active third-party vulnerability research against this product's web and agent-facing surfaces throughout 2026. Because ADAudit Plus is purpose-built to audit and report on Active Directory changes, servers running the product commonly hold read access to sensitive AD data and, per the historical CVE-2022-28219 disclosure, compromise of the underlying host has previously been demonstrated to lead directly to full Active Directory domain compromise. Defenders running any ADAudit Plus build below 8606 (or below 8703 for the later, separate fixes), or agents below build 7060 (Windows), should treat this as an urgent patch-now priority regardless of confirmed in-the-wild activity.

MITRE ATT&CK techniques used in TL-2026-1756

Credential Access

T1003 OS Credential Dumping; T1110.002 Password Cracking; T1187 Forced Authentication; T1552 Unsecured Credentials

Collection

T1005 Data from Local System

Exfiltration

T1020 Automated Exfiltration

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1078.002 Domain Accounts

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-6516

  • Zohocorp — ManageEngine ADAudit Plus (server)
    Vulnerable versions: all builds prior to 8606
    Fixed in: 8606 and later
  • Zohocorp — ADAudit Plus Windows Agent
    Vulnerable versions: builds earlier than 7060
    Fixed in: 7060 or later
  • Zohocorp — ADAudit Plus macOS Agent
    Vulnerable versions: all versions prior to the vendor's latest release at time of advisory
    Fixed in: latest available macOS agent version

Remediation for CVE-2026-6516

Patches

  • ADAudit Plus build 8606 (released 2026-04-17)
  • ADAudit Plus build 8703 (released 2026-06-12) for unrelated SQLi/account-takeover fixes

Immediate actions

  • Update ManageEngine ADAudit Plus server to build 8606 or later via the official service pack
  • Upgrade all Windows ADAudit Plus agents to build 7060 or later (Configuration > Agent Management)
  • Upgrade all macOS ADAudit Plus agents to the latest available version regardless of current version
  • Restrict network exposure of ADAudit Plus Agent API listener ports to trusted, segmented internal hosts only pending confirmation that all servers and agents are patched

Workarounds

  • No vendor-documented workaround beyond patching; restrict network access to Agent API endpoints as a compensating control until patched

Longer-term hardening

  • Place the ADAudit Plus management console and agent-listener endpoints behind a segmented management VLAN not reachable from general user networks or the internet
  • Monitor ADAudit Plus server and agent processes for anomalous child-process spawning or unexpected file writes outside application directories, consistent with the disclosed auth-bypass + path-traversal + OS command injection (CWE-78) chain
  • Track CISA KEV and vendor channels for confirmation of in-the-wild exploitation given the public Horizon3.ai NodeZero Rapid Response exploit-validation test
  • Given ADAudit Plus's privileged Active Directory read access, treat any confirmed compromise of an ADAudit Plus host as a potential domain-compromise incident requiring AD-wide credential rotation review
  • Ensure ADAudit Plus is fully current through build 8703+ to also cover the separately-disclosed SQL injection (CVE-2026-12062) and account-takeover (CVE-2026-11374) fixes, not just the CVE-2026-6516 RCE fix
  • Monitor for outbound NTLM authentication attempts originating from the ADAudit Plus server process — a historical post-exploitation pattern (forced authentication / NTLM relay) documented for this same Agent API attack surface

CVEs associated with CVE-2026-6516

CVE-2026-6516, CVE-2022-28219, CVE-2026-12062

Weaknesses (CWE) in CVE-2026-6516

CWE-78

Timeline of CVE-2026-6516

  • Zohocorp patches the related unauthenticated RCE CVE-2022-28219 (XXE + Java deserialization + path traversal chain in ADAudit Plus Agent APIs) in build 7060 — the same product family and vulnerability class later recurring in CVE-2026-6516.
  • CVE-2022-28219 is published in the National Vulnerability Database, and Horizon3.ai integrates the exploit chain into its NodeZero autonomous pentesting platform as a proactive verification module.
  • Horizon3.ai publishes the full public technical disclosure and red-team blog for CVE-2022-28219, documenting the exact vulnerable ADAudit Plus Agent API endpoints (/api/agent/tabs/agentData XXE, /cewolf/ deserialization) that define the recurring architectural weakness echoed by CVE-2026-6516.
  • The CVE-2026-6516 identifier is reserved the same day build 8606 ships, per the CVE.org/ThreatINT record — consistent with ManageEngine's pattern of silently patching before public disclosure.
  • ManageEngine ships the fix for CVE-2026-6516 in ADAudit Plus build 8606, ahead of public advisory disclosure.
  • ManageEngine ships ADAudit Plus build 8703, fixing two separately-disclosed vulnerabilities in the same product — SQL injection (CVE-2026-12062) and account takeover (CVE-2026-11374) — indicating sustained active third-party vulnerability research against ADAudit Plus through mid-2026.
  • ManageEngine publishes the public security advisory for CVE-2026-6516, crediting researcher Linhlt of VCB and confirming build 8606 as the fix, alongside required Windows agent (build 7060+) and macOS agent upgrades.
  • Systemtek publishes independent coverage summarizing the ManageEngine advisory and remediation guidance for CVE-2026-6516.
  • NVD publishes the CVE-2026-6516 entry with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L (score 10.0, exploitability sub-score 3.9, impact sub-score 6.0) and CWE-78 (OS Command Injection) classification; record status is "Awaiting Analysis."
  • Horizon3.ai publishes an Attack Research entry for CVE-2026-6516 and releases a NodeZero Rapid Response exploit-validation test, closing the gap between disclosure and a demonstrated-working exploit chain to under a week and raising near-term exploitation risk despite no confirmed in-the-wild activity.

Sources cited for CVE-2026-6516

Detection coverage for TL-2026-1756

As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1756 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
27 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats