Vulnerability record · CVE-2016-9498 · published 13 July 2018
CVE-2016-9498: Zohocorp manageengine applications manager deserialization of untrusted data vulnerability
Zohocorp · Manageengine Applications Manager
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Description
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2017/Apr/9 | Mailing ListThird Party Advisory |
| https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html | Vendor Advisory |
| https://www.securityfocus.com/bid/97394/ | Third Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2017/Apr/9 | Mailing ListThird Party Advisory |
| https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html | Vendor Advisory |
| https://www.securityfocus.com/bid/97394/ | Third Party AdvisoryVDB Entry |
Track CVE-2016-9498 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-9498), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
