CVE-2026-6516: Unauthenticated RCE in ManageEngine ADAudit Plus

CVE-2026-6516 is an unauthenticated remote code execution (RCE) vulnerability affecting Zohocorp ManageEngine ADAudit Plus, a critical auditing and compliance product for IT infrastructures. The flaw resides in the agent API, allowing direct system access without any form of authentication. For administrators and IT teams, ADAudit Plus compromise is a strategic threat: the attacker gains control of a tool designed to monitor security itself, undermining visibility into logs, audit trails, and security configurations.

The vulnerability is assigned a CVSS score of 10.0, the maximum possible, and officially classified as critical. Published in NVD on 2026-07-23, it has been known for at least three months. A GitHub signal dated 2026-10-30 indicates that public repositories document tools for identifying and testing this flaw, signaling concrete research community interest. No available data suggests the vulnerability is already being actively exploited in large-scale campaigns, but the presence of public tools and the time elapsed since disclosure demand immediate action.

The priority defense is to update ManageEngine ADAudit Plus to version 8606 or later. Administrators and CISOs must: immediately inventory all ADAudit Plus systems in use; verify installed versions via management console; apply the update with maximum priority, scheduling a maintenance window if necessary; check agent API access logs for anomalous requests before and after patching; implement network access controls to limit agent API exposure to trusted internal networks.

ADAudit Plus is a visibility and compliance tool: its compromise means loss of trust in audit data and audit trails. For organizations subject to regulations such as GDPR, SOC 2, ISO 27001, or PCI DSS, an ADAudit Plus incident can have compliance and notification implications. The lack of authentication and CVSS 10.0 make patching speed essential.