CVE-2023-31099: ManageEngine OPManager authenticated RCE via probe servers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityAuthenticated network-reachable RCE with high CVSS impact and very high EPSS, though not in KEV and requiring valid credentials.

What it is

Zoho ManageEngine OPManager through build 126323 lets an authenticated user achieve remote code execution through probe servers. The flaw carries a CVSS 3.1 base score of 8.8 (HIGH) with a network vector and low privileges required, so a valid low-privilege account is enough to reach code execution on the server. The record does not specify the exact vulnerable code path or the affected build range beyond the stated ceiling.

Impact

An attacker with a valid account gains remote code execution on the OPManager host, giving full compromise of confidentiality, integrity and availability per the CVSS impact ratings. That typically means control of the monitoring server and any credentials or managed devices it touches.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated user can attempt it. The description points to probe servers as the vector, but the record does not detail the exact endpoint or request.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.81555 (99.6th percentile), indicating strong predicted exploitation activity. The only references are the vendor advisory and product pages, with no public exploit tag.

What to do

• Upgrade OPManager past build 126323 using the vendor security update at manageengine.com/network-monitoring/security-updates/cve-2023-31099.html
• Restrict and audit accounts with access to OPManager, removing unused or over-privileged users
• Limit network exposure of OPManager and probe server interfaces to trusted management networks
• Monitor probe server configuration and logs for unauthorized changes or unexpected command execution

Detection

• Review OPManager and probe server logs for anomalous requests or configuration changes from authenticated sessions
• Alert on unexpected child processes or command execution spawned by the OPManager service
• Baseline and monitor probe server settings for unauthorized modification
• Correlate authentication events with subsequent administrative or probe-related actions from the same account

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.