Zoho ManageEngine OpManager MSP advisory for CVE-2026-19599: Remote Code Execution in the Notification Profile module, exploitable by a customer administrator user on the MSP Central installed server via broken access control on an API that runs commands as part of profile functionality.

Vendor severity High on the advisory page; WASOC rates it CVSS 9.9 Critical. Affected and fixed versions (vendor advisory): OpManager MSP 12.8.166 to 12.8.709, fixed in 12.8.710 and above (14 Aug 2026); 12.8.718 to 12.9.001, fixed in 12.9.002 and above (13 Aug 2026); 12.9.100 to 12.9.108, fixed in 12.9.109 and above (14 Aug 2026); 12.9.117 to 12.9.122, fixed in 12.9.123 and above (14 Aug 2026). WASOC 20260924001 (24 Sep 2026) summarises as versions 12.8.709 and below / CVSS 9.9 Critical and reports no exploitation on WA Government networks at time of writing.

Fix enforces strict access control so only MSP Central Server administrators can use the sensitive APIs. (sources: ManageEngine OpManager MSP advisory; WASOC 20260924001)

Correction (27 Oct 2026): the fixed builds were wrong (the card said 128711 and 129125); ManageEngine's advisory lists 12.8.710, 12.9.002, 12.9.109 and 12.9.123 and above for the four affected ranges, which are now given as the vendor writes them.

The CVSS score is now credited to WASOC rather than CVE.report, which is not linked. (source: ManageEngine)