{"metadata": {"vulnerability": "CVE-2026-12591", "count": 18, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-18T09:09:27.284Z", "date_only": false, "value": "2026-06-18T09:09:27.284Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Zohocorp", "record": "CVE-2026-12591", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T07:01:39.670Z", "date_only": false, "value": "2026-11-12T07:01:39.670710Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117602182692339470", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "98eae1eb-c400-49c6-bfea-99c9ebf1f412", "content": "CVE-2026-12591 Privilege Escalation Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.\nhttps://www.cve.org/CVERecord?id=CVE-2026-12591https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html#manageengine #Zohocorp #M365ManagerPlus#CVE_2026_12591#bot", "url": "https://infosec.exchange/users/cve/statuses/117602182692339470"}, {"timestamp": "2026-11-12T07:16:47Z", "date_only": false, "value": "2026-11-12T07:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V53H-Q7R3-WR4W", "record": "GHSA-V53H-Q7R3-WR4W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T07:16:47.260Z", "date_only": false, "value": "2026-11-12T07:16:47.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-12591", "record": "FKIE_CVE-2026-12591", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T07:16:47.260Z", "date_only": false, "value": "2026-11-12T07:16:47.260", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-12591", "record": "FKIE_CVE-2026-12591", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T07:20:04.891Z", "date_only": false, "value": "2026-11-12T07:20:04.891006Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n23wlzaanq2a", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "861aa142-0782-4324-bb5d-5c9042e521e4", "content": "CVE-2026-12591 - m365 manager plus\nVersions of Zoho ManageEngine M365 Manager Plus older than 4818 let a user with technician credentials increase their access beyond what is intended. This could let an attacker run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zohocorp #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n23wlzaanq2a"}, {"timestamp": "2026-11-12T07:30:36.496Z", "date_only": false, "value": "2026-11-12T07:30:36.496873Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117602296517864911", "record": "cve-2026-12591", "field": "creation_timestamp", "uuid": "166fc377-5572-406d-87c1-6e966f85a96a", "content": "CVE-2026-12591: CRITICAL missing authorization in Zohocorp M365 Manager Plus (<v4818). Authenticated users can escalate privileges & achieve RCE. Patch to v4818 ASAP. https://radar.offseq.com/threat/cve-2026-12591-cwe-862-missing-authorization-in-zohocorp-m365-manager-plus-e798505f80da0052 #OffSeq #Vuln #RCE #ManageEngine #PatchTuesday", "url": "https://infosec.exchange/users/offseq/statuses/117602296517864911"}, {"timestamp": "2026-11-12T07:30:39.810Z", "date_only": false, "value": "2026-11-12T07:30:39.810957Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3n23x6uuiz52v", "record": "cve-2026-12591", "field": "creation_timestamp", "uuid": "20fa0d75-b672-47dc-b2ab-70d9360099ed", "content": "Zohocorp M365 Manager Plus <v4818 has a CRITICAL auth flaw (CVE-2026-12591). Authenticated users can escalate privileges & trigger RCE. Upgrade to v4818+ now! https://radar.offseq.com/threat/cve-2026-12591-cwe-862-missing-authorization-in-zohocorp-m365-manager-plus-e798505f80da0052 #OffSeq #Cyber...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3n23x6uuiz52v"}, {"timestamp": "2026-11-12T07:51:48.495Z", "date_only": false, "value": "2026-11-12T07:51:48.495320Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bkjst632vt7ss", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "c0571955-818e-4ad0-8b2b-8250533e3195", "content": "CVE-2026-12591 - Privilege Escalation\nCVE ID : CVE-2026-12591\n \n Published : Nov. 12, 2026, 6:55 a.m. | 20\u00a0minutes ago\n \n Description : Zohocorp ManageEngine\u00a0M365 Manager Plus\u00a0versions below\u00a04818\u00a0is affected by\u00a0an authenticated technician may exploit insufficient permission va...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/bkjst632vt7ss"}, {"timestamp": "2026-11-12T08:07:20.226Z", "date_only": false, "value": "2026-11-12T08:07:20.226151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3n23zajazk32u", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "3048a6f3-066b-4adb-9a4e-ca0180b8d411", "content": "\ud83d\udea8 CVE-2026-12591 \u2014 CVSS 9.9 CRITICAL\n\nZohocorp ManageEngine\u00a0M365 Manager Plus\u00a0versions below\u00a04818\u00a0is affected by\u00a0an authenticated technician may ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-12591\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3n23zajazk32u"}, {"timestamp": "2026-11-12T08:31:25.332Z", "date_only": false, "value": "2026-11-12T08:31:25.332790Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n242lkuh5p2t", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "258b0cbb-47a4-4b55-88fc-e4b538f0b94a", "content": "\ud83d\udd34 CVE-2026-12591 - Critical (9.9)\n\nZohocorp ManageEngine\u00a0M365 Manager Plus\u00a0versions below\u00a04818\u00a0is affected by\u00a0an authenticated ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12591/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n242lkuh5p2t"}, {"timestamp": "2026-11-12T09:32:50Z", "date_only": false, "value": "2026-11-12T09:32:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V53H-Q7R3-WR4W", "record": "GHSA-V53H-Q7R3-WR4W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T09:32:50Z", "date_only": false, "value": "2026-11-12T09:32:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V53H-Q7R3-WR4W", "record": "GHSA-V53H-Q7R3-WR4W", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T09:45:12.674Z", "date_only": false, "value": "2026-11-12T09:45:12.674914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3n246pjikc22i", "record": "CVE-2026-12591", "field": "creation_timestamp", "uuid": "6368505c-3d57-4ef7-83f8-c510cd4aefdd", "content": "Don\u2019t miss this new critical one. CVE-2026-12591 \u2014 CVSS 9.9.\n\nZohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-12591/\n\n#fcvulns #CWE862", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3n246pjikc22i"}, {"timestamp": "2026-11-12T10:22:23.603Z", "date_only": false, "value": "2026-11-12T10:22:23.603163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n275jvxj26pi", "record": "cve-2026-12591", "field": "creation_timestamp", "uuid": "761c62d2-eb1c-4d31-ad3d-0377cb6f73d3", "content": "Developing: Critical Zohocorp ManageEngine M365 Manager Plus Vulnerability (CVE-2026-12591)\nhttps://cyber.eventmonitor.net/incident/EM-20261112-IKZ2/critical-zohocorp-manageengine-m365-manager-plus-vulnerability-cve-2026-12591/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n275jvxj26pi"}], "metrics": {"as_of": "2026-11-12T12:14:52.498Z", "anchors": {"origin": {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 19160.803757, "hours": 5.322445488055556, "days": 0.22176856200231485, "min_seconds": 19160.803757, "max_seconds": 19160.803757, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T06:55:31.695Z", "date_only": false, "value": "2026-11-12T06:55:31.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-12591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T12:14:52.498Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}