Warning: Multiple Vulnerabilities in Zoho ManageEngine Applications Manager, OpManager & Firewall Analyzer, Patch Immediately!

This advisory from the Centre for Cybersecurity Belgium describes six critical-to-high vulnerabilities in Zoho ManageEngine Applications Manager, OpManager (including MSP and APM plugin variants) and Firewall Analyzer — including a hard-coded Google Cloud service-account key (CVE-2026-86708), multiple OS/command injection flaws enabling remote code execution (CVE-2026-19599, CVE-2026-76978), an SSO authentication bypass (CVE-2026-75825), XML injection in policy comparison (CVE-2026-76979), and syslog-related credential exposure (CVE-2026-76980). The advisory recommends immediate patching to specified builds/versions, invalidating and rotating exposed keys and firewall credentials, restricting syslog ingestion, and increasing monitoring for related suspicious activity.