ManageEngine has 3 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The median CVSS is 8.1 (high). Most affected products: SharePoint Manager Plus (2), Asset Explorer (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-119680High· 8.5Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature47CVE-2025-8309High· 8.1User privilege escalation vulnerability45CVE-2026-119682High· 7.9Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus44
ManageEngine vulnerabilities
CVEs affecting ManageEngine, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-119682High· 7.9Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify…
CVE-2026-119680High· 8.5Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript i…
CVE-2025-8309High· 8.1User privilege escalation vulnerability
There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer version…