CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255...

7.5 High

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

8.24%Up 7.1 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2018-12999
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-12999
Updated: 2026-11-02

EUVDEUVD-2018-4950 No score

Record: EUVD-2018-4950
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pf9m-66cq-7fx9 7.5

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255...

Record: GHSA-pf9m-66cq-7fx9
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

Affected products

zohocorp manageengine desktop central

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12999 is a high vulnerability (CVSS 7.5) in Zohocorp Manageengine Desktop Central, published June 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.24%, the 94th percentile. No source names a fixed version.