CVE-2015-2560: Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users wit...

Security readout for executives and security teams

This vulnerability could let a remote attacker change passwords for Administrator-role users in ManageEngine Desktop Central 9 before build 90135. That can turn into administrative control of the endpoint-management platform, which is business-critical because it manages many devices. Exposure is limited to organizations running ManageEngine Desktop Central 9 before build 90135. Risk is higher where the Desktop Central web application or affected servlet is reachable from untrusted networks. Treat as high priority for any legacy Desktop Central 9 environment. Administrative password modification in an endpoint-management tool can create broad operational and security impact, even though active exploitation is not evidenced here. Mitigation focus: Upgrade ManageEngine Desktop Central 9 to build 90135 or later.; Review the ManageEngine advisory for vendor-supported remediation guidance.; Restrict Desktop Central access to trusted administrative networks..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.