Description

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-07T11:17:35.687Z",
  "pubdate": "2026-09-07T11:17:35.687Z",
  "executiveSummary": "ManageEngine Endpoint Central versions prior to 11.4.2540.23 are susceptible to a privilege escalation vulnerability during the JAR file extraction process.\nThe vulnerability originates from improper handling or validation of archive contents during extraction, which can be leveraged by a local attacker to execute arbitrary code with elevated system privileges.\nSuccessful exploitation allows an authenticated user to move laterally from a restricted context to a highly privileged one, potentially compromising the integrity and confidentiality of the entire endpoint management infrastructure.\nThis flaw presents significant risk, as Endpoint Central typically operates with high-level system permissions, making it a prime target for privilege persistence and lateral movement within an enterprise environment.\nAttackers require local access to the system to trigger the extraction process, but do not necessarily require initial administrative access to initiate the exploit chain if the extraction occurs under a system-level service or user context.\nOrganizations using affected versions should prioritize immediate patching to the baseline version 11.4.2540.23 or newer to mitigate the exposure.",
  "technicalDetails": "The vulnerability resides within the file processing logic of Zohocorp ManageEngine Endpoint Central, specifically during the handling of JAR (Java Archive) files. In affected versions below 11.4.2540.23, the system fails to adequately sanitize or validate the paths and contents defined within the JAR file structure during the extraction phase.\nThe root cause is an insecure implementation of the file decompression or extraction routine, which fails to prevent directory traversal or file replacement attacks. When the application extracts a malicious JAR, it may allow the extraction of files into sensitive directories outside of the intended, isolated working directory. By crafting a JAR file containing entries with relative path components (e.g., ../../../), an attacker can overwrite critical binary files, configuration files, or script files that are subsequently executed by the application or the operating system.\nThe attack flow typically follows these steps: First, an attacker with local access identifies a functionality within Endpoint Central that triggers the extraction of an uploaded or received JAR file. Second, the attacker prepares a malicious JAR archive designed to target a specific executable or library used by a system-level process. Third, the attacker initiates the extraction routine. Fourth, the insecure extraction logic facilitates the placement of the attacker's payload into a privileged directory, effectively replacing a legitimate system file or planting a new executable in a path that the system service is configured to load or execute.\nOnce the malicious file is in place, the attacker relies on the standard operation of the service to execute the payload. Because Endpoint Central often runs with SYSTEM or root privileges, the executed payload inherits these elevated permissions. This results in arbitrary code execution with the highest possible level of local authority.\nThis vulnerability is particularly impactful because it bypasses standard access control lists (ACLs) by subverting the file system interaction of the privileged service. It does not require network exposure if the initial access to the application is restricted to local interfaces; however, if the vulnerable service is reachable via web interfaces, it may broaden the attack surface for a remote attacker who has already gained low-privileged access to the web dashboard. Post-exploitation impact includes full system control, credential dumping, persistence installation, and the ability to distribute malicious policies or payloads to all managed endpoints connected to the central server."
}