rootpwn

high · CVSS v3 7.5

CVE-2026-18911

ManageEngine DataSecurity Plus contains an agent authentication bypass vulnerability in versions prior to 6310. This flaw allows unenrolled

Overview

ManageEngine DataSecurity Plus contains an agent authentication bypass vulnerability in versions prior to 6310. This flaw allows unenrolled agents to send unauthorized requests to the server. It matters because unauthorized entities could interact with the application interface without proper credential validation.

Description

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

Impact

This vulnerability impacts the integrity and availability of the DataSecurity Plus environment by permitting unauthenticated agent communications. Unauthorized actors could potentially flood or spoof agent requests, disrupting data security monitoring. Organizations utilizing vulnerable versions face an increased risk of unauthorized access within their internal network segments.

Remediation

Upgrade ManageEngine DataSecurity Plus to version 6310 or the latest available vendor-supplied patch. Restrict network access to the DataSecurity Plus agent communication ports to trusted internal subnets only. Monitor agent enrollment logs for unusual or unauthorized registration attempts.

Risk context

Rated as a high severity issue with a CVSS v3 score of 7.5, indicating a significant risk to enterprise data security infrastructure. Organizations should apply patches promptly to mitigate potential unauthorized interactions.

Affected products

  • ManageEngine DataSecurity Plus < 6310

Scores

Severity
high
CVSS v2
6.1
CVSS v3
7.5
CVSS v4
—
EPSS
—

Authentication Bypass ManageEngine DataSecurity Plus Access Control High Severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis