Back
CVE-2016-9498
ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
Critical9.8EPSS 21.2%
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 21.2% · top 2.4% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
ManageEngine · Applications Manager
- affected 12
- affected 13
References (3)
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 97394 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .