# CVE-2026-6516: Unauthenticated Remote Code Execution in ManageEngine ADAudit Plus (CVSS 10.0)

> A critical pre-authentication vulnerability chain in ManageEngine ADAudit Plus Agent APIs lets an unauthenticated network attacker combine authentication bypass with path traversal to write files outside their intended directory and achieve remote code execution. Fixed silently in build 8606 (released 2026-04-17); publicly disclosed by the vendor on 2026-07-23, added to NVD on 2026-07-24 (CWE-78, CVSS 10.0), and followed by a Horizon3.ai NodeZero Rapid Response exploit-validation test on 2026-07-28 — no confirmed in-the-wild exploitation as of publication.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1756
- **ID:** TL-2026-1756
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-6516, CVE-2022-28219, CVE-2026-12062

## Description

CVE-2026-6516 affects Zohocorp ManageEngine ADAudit Plus, an on-premises Active Directory change-auditing and compliance tool, in all builds prior to 8606. According to the vendor advisory, "vulnerabilities in ADAudit Plus Agent APIs could allow authentication bypass and path traversal," and "an unauthenticated adversary could combine these vulnerabilities to potentially achieve remote code execution" by writing files outside their intended directory. NVD assigns CWE-78 (Improper Neutralization of Special Elements used in an OS Command) as the underlying root-cause weakness class, and rates the flaw CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) — a network-reachable, low-complexity, zero-privilege, zero-interaction exploit with a scope change and high confidentiality/integrity impact. NVD's CVSS breakdown lists an Exploitability sub-score of 3.9 and Impact sub-score of 6.0; the CVE identifier itself was reserved on 2026-04-17, the same day build 8606 shipped, and the record remained in "Awaiting Analysis" status as of the 2026-07-24 NVD update.

The vendor's remediation guidance requires updating the ADAudit Plus server to build 8606 and separately upgrading Windows agents to build 7060 or later, and macOS agents to their latest release regardless of current version. Notably, the required Windows agent minimum (build 7060) is the exact build that fixed the prior related flaw, CVE-2022-28219 (an unauthenticated XXE + Java deserialization + path traversal chain in the same ADAudit Plus Agent API surface, patched 2022-03-30 and documented by Horizon3.ai under the title "Unauthenticated XXE to RCE and Domain Compromise"). Horizon3.ai's 2022 disclosure documents the exact mechanics of that recurrence-prone attack surface: a first-stage XXE injection against the unauthenticated `/api/agent/tabs/agentData` endpoint (vulnerable `ProcessTrackingListener` class using Java's default, externally-resolving `DocumentBuilderFactory`), used to abuse a JAR-protocol blocking-server trick to cache an attacker-supplied serialized Java payload; a second-stage path-traversal request against the `/cewolf/` charting endpoint (`img` parameter, `.png` extension bypass) that triggers untrusted deserialization of the cached payload via the vulnerable third-party Cewolf `FileStorage` class, using a `ysoserial` `CommonsBeanutils1` gadget chain for code execution. Post-exploitation in that 2022 chain included forced NTLM authentication (the XXE-triggered Java HTTP client authenticates outbound), enabling hash capture/relay with Responder and ntlmrelayx, plus direct extraction of encrypted, often domain-admin-privileged Active Directory credentials stored in the ADAudit Plus database — leading to full domain compromise. This strongly suggests CVE-2026-6516 is a recurrence of the same architectural weakness — unauthenticated agent-to-server upload/report endpoints that trust attacker-influenced file paths — rather than an entirely new code path, though the vendor has not disclosed the specific vulnerable endpoint(s) or a full technical root-cause writeup for the 2026 flaw, and Horizon3.ai's 2026 Attack Research entry likewise stops at the vendor's own two-stage (auth bypass + path traversal) description without new endpoint or payload detail.

No PoC exploit code has been published publicly (no GitHub repository, Metasploit module, or exploit-database entry was found), and the flaw is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Horizon3.ai's Attack Research team published an entry for the CVE on 2026-07-28 and released a NodeZero Rapid Response test — a validated, working exploit-chain test used to prove real-world exploitability to Horizon3.ai customers — five days after the public advisory. This closes the gap between disclosure and a demonstrated-working exploit chain to under a week, substantially raising near-term mass-exploitation risk given ADAudit Plus's typical deployment as a privileged, domain-integrated auditing tool with likely internet- or intranet-wide reachability at many organizations.

ADAudit Plus build 8606 was not a single-issue release: ManageEngine's release notes credit a researcher ("Gus 616") with a concurrently-fixed set of Cross-Site Request Forgery vulnerabilities in the Mail settings and SSO/SAML configuration modules, shipped in the same build as the CVE-2026-6516 fix. Two months later, build 8703 (2026-06-12) fixed two further, unrelated ADAudit Plus vulnerabilities — SQL injection (CVE-2026-12062) and account takeover (CVE-2026-11374) — indicating sustained, active third-party vulnerability research against this product's web and agent-facing surfaces throughout 2026. Because ADAudit Plus is purpose-built to audit and report on Active Directory changes, servers running the product commonly hold read access to sensitive AD data and, per the historical CVE-2022-28219 disclosure, compromise of the underlying host has previously been demonstrated to lead directly to full Active Directory domain compromise. Defenders running any ADAudit Plus build below 8606 (or below 8703 for the later, separate fixes), or agents below build 7060 (Windows), should treat this as an urgent patch-now priority regardless of confirmed in-the-wild activity.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1078.002 Domain Accounts
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1187 Forced Authentication
- T1110.002 Password Cracking
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1005 Data from Local System
- T1020 Automated Exfiltration

## Sources

- [Horizon3.ai Attack Research: CVE-2026-6516](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-6516/)
- [Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516) fixed in build 8606 | ManageEngine ADAudit Plus](https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html)
- [NVD - CVE-2026-6516 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-6516)
- [Zohocorp Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516)](https://www.systemtek.co.uk/2026/07/zohocorp-unauthenticated-remote-code-execution-vulnerability-cve-2026-6516/)
- [CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus](https://horizon3.ai/attack-research/disclosures/red-team-blog-cve-2022-28219/)
- [Zoho ManageEngine ADAudit Plus bug gets public RCE exploit](https://www.bleepingcomputer.com/news/security/zoho-manageengine-adaudit-plus-bug-gets-public-rce-exploit/)
- [Experts shared PoC exploit code for RCE in Zoho ManageEngine ADAudit Plus tool](https://securityaffairs.com/132797/hacking/zoho-manageengine-adaudit-plus-rce.html)
- [CVE-2022-28219 Impact, Exploitability, and Mitigation Steps](https://www.wiz.io/vulnerability-database/cve/cve-2022-28219)
- [CVE-2026-6516 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-6516)
- [ADAudit Plus Release Notes](https://www.manageengine.com/products/active-directory-audit/adaudit-plus-release-notes.html)
- [SQL Injection Vulnerability (CVE-2026-12062) | ManageEngine ADAudit Plus](https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html)
- [Account Takeover Vulnerability (CVE-2026-11374) | ManageEngine ADAudit Plus](https://www.manageengine.com/products/active-directory-audit/advisory/CVE-2026-11374.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1756