PT-2026-97280 · Manageengine · Netflow Analyzer+2
CVE-2026-12370
·
Published
2026-09-23
·
Updated
2026-09-24
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
ManageEngine OpManager versions prior to 12.8.668
ManageEngine NetFlow Analyzer versions prior to 12.8.668
ManageEngine Network Configuration Manager versions prior to 12.8.668
Description
Server-Side Template Injection (SSTI) occurs during Configlet processing, which can allow an attacker to achieve Remote Code Execution (RCE). SSTI is a flaw where an attacker can inject malicious code into a template that is then executed on the server.
Recommendations
Update ManageEngine OpManager to version 12.8.668 or later.
Update ManageEngine NetFlow Analyzer to version 12.8.668 or later.
Update ManageEngine Network Configuration Manager to version 12.8.668 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netflow Analyzer
Network Configuration Manager
Opmanager