ManageEngine ADAudit Plus: Pre-authentication remote code execution (CVE-2026-6516)
A public exploit and scanner have been published for CVE-2026-6516, a pre-authentication remote code execution vulnerability in ManageEngine ADAudit Plus Agent APIs.
CVE search metadata
CVE search record: CVE-2026-6516. Severity: critical. CVSS: 10.0. EPSS: 4.73%. KEV: no. Product: ADAudit Plus, Windows Agents, macOS Agents. Brief: ManageEngine ADAudit Plus: Pre-authentication remote code execution (CVE-2026-6516). Brief link: https://feed.craftedsignal.io/briefs/2026-10-adaudit-rce/
Triage facts
Revision 1- Applicability
- ADAudit Plus, Windows Agents +1
- Evidence
- Not observed
- Severity
- High
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 30, 21:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2026-6516 is a pre-authentication remote code execution vulnerability in the Agent APIs of ManageEngine ADAudit Plus. The vulnerability involves authentication bypass and path traversal, potentially allowing an unauthenticated attacker to write files outside of the intended directory. The vulnerability is reported with a CVSS v3.1 base score of 10.0. A public scanner is available to identify Agent API endpoints that are reachable without authentication.
Immediate actions
Review vendor advisory and apply recommended updates for ADAudit Plus and associated agents.
Threat Hunt
Identify Agent API endpoints responding without authentication.