{"metadata": {"vulnerability": "CVE-2026-119682", "count": 14, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-30T07:16:51Z", "date_only": false, "value": "2026-10-30T07:16:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-119682", "record": "CVE-2026-119682", "field": "creation_timestamp", "uuid": "53d527fe-cffa-4f6a-8d7a-02470d88cb52", "url": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-119682"}, {"timestamp": "2026-10-30T12:59:00Z", "date_only": false, "value": "2026-10-30T12:59:00.000Z", "kind": "milestone", "label": "Published", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T14:18:00Z", "date_only": false, "value": "2026-10-30T14:18:00.000Z", "kind": "milestone", "label": "Reserved", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T14:18:42.530Z", "date_only": false, "value": "2026-10-30T14:18:42.530Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119682", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T14:20:49.039Z", "date_only": false, "value": "2026-10-30T14:20:49.039715Z", "kind": "other", "label": "Updated", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T14:21:21.154Z", "date_only": false, "value": "2026-10-30T14:21:21.154Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119682", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T14:21:21.154Z", "date_only": false, "value": "2026-10-30T14:21:21.154Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119682", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T14:21:21.154Z", "date_only": false, "value": "2026-10-30T14:21:21.154Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CIRCL", "record": "CVE-2026-119682", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T14:40:52.646Z", "date_only": false, "value": "2026-10-30T14:40:52.646064Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117530378383522701", "record": "CVE-2026-119682", "field": "creation_timestamp", "uuid": "7fd7d8ae-027b-4764-bc33-0848c015eb47", "content": "CVE-2026-119682 Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119682https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4507-released#manageengine #ManageEngine #SharePointManagerPlus#CVE_2026_119682#bot", "url": "https://infosec.exchange/users/cve/statuses/117530378383522701"}, {"timestamp": "2026-10-30T15:16:51Z", "date_only": false, "value": "2026-10-30T15:16:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RFRW-7QRH-FH28", "record": "GHSA-RFRW-7QRH-FH28", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-30T15:16:51.327Z", "date_only": false, "value": "2026-10-30T15:16:51.327", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119682", "record": "FKIE_CVE-2026-119682", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T15:34:40Z", "date_only": false, "value": "2026-10-30T15:34:40Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RFRW-7QRH-FH28", "record": "GHSA-RFRW-7QRH-FH28", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T15:34:40Z", "date_only": false, "value": "2026-10-30T15:34:40Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RFRW-7QRH-FH28", "record": "GHSA-RFRW-7QRH-FH28", "field": "modified"}, {"timestamp": "2026-10-30T19:37:07.073Z", "date_only": false, "value": "2026-10-30T19:37:07.073", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119682", "record": "FKIE_CVE-2026-119682", "field": "lastModified"}], "metrics": {"as_of": "2026-11-02T04:28:28.772Z", "anchors": {"origin": {"timestamp": "2026-10-30T12:59:00Z", "date_only": false, "value": "2026-10-30T12:59:00.000Z", "kind": "milestone", "label": "Published", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T12:59:00Z", "date_only": false, "value": "2026-10-30T12:59:00.000Z", "kind": "milestone", "label": "Published", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 228568.772506, "hours": 63.49132569611111, "days": 2.64547190400463, "min_seconds": 228568.772506, "max_seconds": 228568.772506, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T12:59:00Z", "date_only": false, "value": "2026-10-30T12:59:00.000Z", "kind": "milestone", "label": "Published", "source": "gna-1 \u00b7 GCVE-1-2026-20186", "record": "GCVE-1-2026-20186", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T04:28:28.772Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}