CVE-2025-5496CWE-269privilege-escalation

CVE-2025-5496

Low · published October 21, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-10-21T14:15Z
Affected products (2)
ProductVersionsFixed in
zohocorp/manageengine_endpoint_central< 11.4.2508.1411.4.2508.14
zohocorp/manageengine_endpoint_central≥ 11.4.2510.01, < 11.4.2516.0611.4.2516.06
References (1)
https://www.manageengine.com/products/desktop-central/kb/arbitrary-file-deletion-allows-local-privilege-escalation.html · 0fc0942c-577d-436f-ae8e-945763c79b02
EPSS history
Timeline
  • 21 OCT 10:04Z
    Arbitrary File Deletion
    cvelistv5