Zohocorp ManageEngine ADAudit Plus: remote code execution

Zohocorp ManageEngine ADAudit Plus

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

Fix it

Upgrade to ManageEngine ADAudit Plus 8606

First seen: 30 Oct 2026
Last update: 30 Oct 2026, 19:17 UTC
Fixed in: 8606
Identifiers: CVE-2026-6516
CVSS: 10.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Zohocorp ManageEngine ADAudit Plus: remote code execution
Severity: critical. Patch status: patched.
Affected: Zohocorp ManageEngine ADAudit Plus
Fixed in: 8606
Ids: CVE-2026-6516

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

## Steps
1. Search the repo, its CI and infra config for Zohocorp ManageEngine ADAudit Plus. If present, report the version in use and whether it's affected.
2. Fix by release line: ManageEngine ADAudit Plus: 8606.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| ManageEngine ADAudit Plus | fixed | 8606 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-6516") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-6516 https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html
https://pwned.coffee/i/zohocorp-manageengine-adaudit-plus-remote-code-execution-cve-2026-6516

Timeline

30 Oct 2026, 19:17 UTC
Fix status: unknown → patched.
30 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
ManageEngine ADAudit Plus before 8606 8606 CVE record (CNA) checked 30 Oct
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA Zohocorp) for CVE-2026-6516
Last checked: 30 Oct 2026, 19:17 UTC

Product	Affected	Fixed in	Source
ManageEngine ADAudit Plus	before 8606	8606	CVE record (CNA) checked 30 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee