CVE-2018-7890: ManageEngine Applications Manager testCredential.do command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS of 9.8, public exploit code and a very high EPSS score makes this an urgent patch target.

What it is

Zoho ManageEngine Applications Manager before 13.6 (build 13640) exposes the testCredential.do endpoint, which validates supplied credentials by reaching out to a specified system and executing a PowerShell script. When the specified system is OfficeSharePointServer, the username and password parameters passed to that script are not validated, allowing command injection. The endpoint is publicly accessible, so the flaw is remotely reachable and trivially exploitable.

Impact

An unauthenticated attacker can execute arbitrary commands on the Applications Manager server, leading to full compromise of confidentiality, integrity and availability. Because the product is a monitoring platform, it may hold credentials for and reach into many managed systems.

Attack surface

Reached over the network via the publicly accessible testCredential.do endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The attacker supplies the system type plus username and password parameters that are passed unvalidated into a PowerShell script.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.788 probability, 99.57th percentile) and multiple references are tagged Exploit, including a Metasploit pull request and an Exploit-DB entry, indicating public exploit code exists.

What to do

• Upgrade ManageEngine Applications Manager to 13.6 build 13640 or later, per the vendor security update.
• If immediate upgrade is not possible, restrict network access to the testCredential.do endpoint and the Applications Manager web interface to trusted management networks only.
• Place the Applications Manager instance behind authentication-aware reverse proxy or WAF rules that block or tightly control requests to testCredential.do.
• Audit and rotate any credentials stored in or reachable from the Applications Manager instance, since command execution may expose them.
• Monitor vendor advisories for follow-up fixes and confirm the deployed build number after patching.

Detection

• Search web/proxy logs for POST requests to testCredential.do, especially with system parameters referencing OfficeSharePointServer or with shell metacharacters in username/password fields.
• Monitor for child processes spawned by the Applications Manager service, particularly powershell.exe or cmd.exe launched from the application's process tree.
• Alert on outbound connections from the Applications Manager host to unexpected destinations that could indicate post-exploitation activity.
• Review Applications Manager logs for credential-test actions against OfficeSharePointServer that were not initiated by known administrators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.