Description

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-07T11:17:36.560Z",
  "pubdate": "2026-09-07T11:17:36.560Z",
  "executiveSummary": "ManageEngine Endpoint Central versions below 11.5.2605.01 are susceptible to a Local Privilege Escalation (LPE) vulnerability stemming from improper DLL loading mechanisms.\nThe vulnerability arises from the application's failure to securely validate or restrict the directory path from which it loads dynamic link libraries, facilitating a DLL Hijacking attack vector.\nAn authenticated local attacker with low-level privileges can exploit this flaw to execute arbitrary code with elevated system-level permissions (e.g., SYSTEM or Administrator).\nThis vulnerability poses a significant security risk, as it permits lateral movement, persistence establishment, and complete control over the compromised host operating system.\nSuccessful exploitation requires local access to the target environment where the vulnerable software is deployed. Given the nature of the application as an endpoint management tool, compromise of the agent or server often grants an adversary broad control over managed network assets.",
  "technicalDetails": "The root cause of this vulnerability is an insecure library loading mechanism where the ManageEngine Endpoint Central executable attempts to load a required DLL file from an untrusted or insecure directory path that lacks proper access control or integrity verification.\nIn Windows environments, applications that use insecure search orders or absolute paths pointing to user-writable directories are susceptible to DLL hijacking. If the application searches for a specific DLL in the current working directory, the PATH environment variable, or other predictable locations before checking protected system directories, an attacker can place a malicious crafted DLL with the same name as the legitimate one in that search path.\nThe attack flow proceeds as follows: First, an attacker identifies the vulnerable process and the specific DLL name it expects to load. Second, the attacker utilizes low-privileged access to place a malicious DLL in a directory that resides earlier in the application's search order. Third, upon the next execution or restart of the ManageEngine Endpoint Central service or associated component, the application inadvertently loads the malicious DLL instead of the intended system file.\nBecause many ManageEngine Endpoint Central components execute with SYSTEM-level privileges to perform administrative management tasks, the injected code within the malicious DLL inherits these elevated permissions. This allows the adversary to bypass User Account Control (UAC) and execute arbitrary system commands, install backdoors, or exfiltrate sensitive data from the endpoint.\nThis vulnerability affects all ManageEngine Endpoint Central installations prior to version 11.5.2605.01. The flaw resides within the executable binary or service component responsible for library initialization. Since the exploit triggers during the loading phase of the application lifecycle, it does not require network interaction, focusing exclusively on local exploitation primitives.\nThe post-exploitation impact includes full system compromise. An attacker achieving code execution at the SYSTEM level can disable security software, modify kernel-level structures, create new administrative users, or move laterally across the network by leveraging credentials stored or cached by the Endpoint Central agent. The reliance on predictable load paths makes this a classic and highly effective technique for privilege escalation in enterprise environments."
}