Zoho's ManageEngine M365 Manager Plus has a critical privilege escalation flaw that could let a low-privileged technician gain far wider powers and, in some cases, run code on the server. The vulnerability, tracked as CVE-2026-12591, carries a CVSS score of 9.9 out of 10 and affects all builds below 4818, according to the National Vulnerability Database, which published the record on 12 November 2026.

M365 Manager Plus is an administration tool for Microsoft 365, used by IT teams to manage users, mailboxes, groups, licences and security settings across an organisation's cloud tenancy. Its delegated administration feature is meant to hand technicians a limited slice of that power, such as managing one department's accounts, while keeping full control with senior administrators. The flaw breaks that boundary. According to the National Vulnerability Database, an authenticated technician can exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.

A missing authorisation check

The weakness is classed as missing authorisation, tracked as CWE-862. In plain terms, the product checked that the user was logged in, but did not properly check whether that user was allowed to carry out the delegated administration action they requested. The flaw needs a valid technician account, so it is not open to strangers on the internet, but any account with technician access could potentially use it.

That distinction still leaves a serious risk. Technician accounts are far more numerous than full administrator accounts, and they are the accounts most likely to be phished or shared. Once an attacker holds one, the flaw could turn a limited foothold into control over Microsoft 365 administration, and the possibility of code execution on the server raises the stakes further still. The CVSS vector published with the record reflects that severity, with network access, low attack complexity, low privileges required and high impact on confidentiality, integrity and availability.

Update to build 4818

The fix is straightforward: update M365 Manager Plus to build 4818 or later. Zoho has published its own advisory for CVE-2026-12591, which is linked from the NVD record, and administrators should check their installed build number rather than assuming a recent update covered it. Any deployment still running a build below 4818 is affected.

Teams that cannot patch immediately should review who holds technician access and trim delegated administration roles to the minimum each person needs. Audit logs for the delegated administration interface should also be checked for actions that fall outside a technician's assigned scope, since privilege escalation of this kind can be hard to spot after the event.

No exploitation reported yet

There is no reported evidence so far that CVE-2026-12591 has been exploited in the wild, and it has not been added to the US Cybersecurity and Infrastructure Security Agency's list of known exploited vulnerabilities. That is reassuring, but ManageEngine products are widely deployed in enterprise and government networks, and flaws in them have been targeted by attackers in the past, so a 9.9 score with a public advisory deserves prompt attention. Organisations running M365 Manager Plus should patch to build 4818, confirm the update took effect, and review delegated roles as part of the same exercise.