ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution…

CVE-2026-19599 is an OS command injection (CWE-78) in the Notification Profile module of ManageEngine OpManager MSP, the multi-tenant edition purpose-built for managed service providers. The Notification Profile feature includes a "Run Command" capability that executes system-level commands when monitoring alarms fire. The vulnerability allows a user with the customer administrator role on the MSP Central server to inject arbitrary OS commands through unsanitized variable values, achieving full remote code execution on the underlying server. Affected versions are 12.8.709 and below; the fix ships in build 128710 (version 12.8.710) and later.

ZohoCorp rates this CRITICAL at 9.9, and the CVSS vector reflects Scope: Changed with all-High CIA impact—defensible on paper because a compromised MSP Central server holds SNMP community strings, WMI credentials, SSH keys, and probe-to-central trust for *every customer network*. However, the vendor’s own advisory quietly notes the prerequisite: the attacker must already be authenticated as a customer administrator on the MSP Central web console. That is not PR:N (unauthenticated)—it is a named administrative role. The 9.9 overstates the ease of initial access. A realistic reassessment lands at HIGH 8.5: the authentication gate and the overwhelmingly internal deployment posture of MSP Central reduce the probability of opportunistic exploitation, but the catastrophic multi-tenant blast radius prevents any downgrade below HIGH.

1. Upgrade to build 128710 or 129124 immediately — The vendor patch is available same-day. This is the definitive fix. Per noisgate remediation SLA for HIGH, deploy within 180 days; however, given the management-plane blast radius, aim for 30 days or less. Download from ManageEngine service packs.
2. Restrict Notification Profile write access to MSP super-admins only — Remove Notification Profile create/edit permissions from customer administrator roles. This eliminates the attack surface without patching. Deploy within 30 days per noisgate mitigation SLA for HIGH.
3. Enforce MFA on all OpManager MSP Central admin accounts — Adding MFA (via ADSelfService Plus, Duo, or SAML IdP) to the MSP Central login raises the bar from stolen credentials to stolen credentials + second factor. Deploy within 30 days.
4. Enable command-line audit logging on the OpManager server — On Windows, deploy Sysmon with Event ID 1 logging; on Linux, configure auditd with execve syscall logging. Alert on any child process spawned by the OpManager Java service that is not in an allowlist (e.g., cmd.exe, /bin/sh, powershell.exe). Deploy within 30 days.
5. Segment MSP Central on a dedicated management VLAN — Ensure the OpManager MSP Central server is only reachable from authorized admin workstations and probe subnets. Block all inbound access from general corporate or internet-facing networks. This limits who can even reach the login page. Deploy within 30 days.
6. Rotate all stored monitoring credentials after patching — Because OpManager stores device credentials that would be exposed on compromise, rotate all SNMP community strings, WMI accounts, SSH keys, and Telnet passwords stored in OpManager after applying the patch. This closes the window if the vuln was silently exploited before patch deployment.

Run this script on the OpManager MSP Central server as a local administrator. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-19599.ps1. No network access or credentials required—it reads the local product.conf file.

# Check-CVE-2026-19599.ps1
# Checks ManageEngine OpManager MSP for CVE-2026-19599 (OS Command Injection)
# Run on the OpManager MSP Central server as local admin.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$vulnBuild = 128709
$found = $false

# Common install paths
$searchPaths = @(
    'C:\ManageEngine\OpManager',
    'C:\Program Files\ManageEngine\OpManager',
    'C:\Program Files (x86)\ManageEngine\OpManager',
    'D:\ManageEngine\OpManager'
)

foreach ($base in $searchPaths) {
    $confFile = Join-Path $base 'conf\product.conf'
    if (Test-Path $confFile) {
        $found = $true
        $content = Get-Content $confFile -Raw
        if ($content -match 'build_number\s*=\s*(\d+)') {
            $buildNum = [int]$Matches[1]
            Write-Host "OpManager install found at: $base"
            Write-Host "Detected build number: $buildNum"
            Write-Host "Vulnerable threshold:  <= $vulnBuild"
            if ($buildNum -le $vulnBuild) {
                Write-Host 'VULNERABLE - CVE-2026-19599 applies to this build.' -ForegroundColor Red
                exit 1
            } else {
                Write-Host 'PATCHED - Build is above the vulnerable range.' -ForegroundColor Green
                exit 0
            }
        } else {
            Write-Host "UNKNOWN - Could not parse build_number from $confFile" -ForegroundColor Yellow
            exit 2
        }
    }
    # Also check about.properties as fallback
    $aboutFile = Join-Path $base 'html\about.properties'
    if ((-not $found) -and (Test-Path $aboutFile)) {
        $found = $true
        $content = Get-Content $aboutFile -Raw
        if ($content -match 'build_number\s*=\s*(\d+)') {
            $buildNum = [int]$Matches[1]
            Write-Host "OpManager install found at: $base"
            Write-Host "Detected build number: $buildNum"
            Write-Host "Vulnerable threshold:  <= $vulnBuild"
            if ($buildNum -le $vulnBuild) {
                Write-Host 'VULNERABLE - CVE-2026-19599 applies to this build.' -ForegroundColor Red
                exit 1
            } else {
                Write-Host 'PATCHED - Build is above the vulnerable range.' -ForegroundColor Green
                exit 0
            }
        }
    }
}

if (-not $found) {
    Write-Host 'UNKNOWN - ManageEngine OpManager installation not found in standard paths.' -ForegroundColor Yellow
    Write-Host 'Set $searchPaths to include your custom install directory and re-run.'
    exit 2
}

1. ManageEngine OpManager Security Updates
2. Strix.ai CVE-2026-19599 Detail
3. TheHackerWire CVE-2026-19599 PoC & Exploit Status
4. OffSeq Threat Radar CVE-2026-19599
5. SecurityOnline - Critical ManageEngine Vulnerabilities
6. ManageEngine OpManager MSP Architecture
7. ManageEngine OpManager Service Packs
8. Shodan ManageEngine OpManager CVEDB