Security readout for executives and security teams
Plain-English summary
A logged-in remote user could abuse the iManager certificate upload feature in affected NetIQ Access Manager releases to upload JSP content that runs as the iManager user. This is an authenticated code execution issue in a management component, so exposed or broadly accessible admin interfaces raise business risk.
Executive priority
Prioritize remediation for internet-reachable or broadly accessible iManager systems. The issue requires login, but successful abuse could execute code in a privileged management application context. Legacy deployments should be upgraded or isolated promptly.
Technical view
CVE-2016-5750 affects NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2. The certificate upload feature in iManager accepted JSP pages that could execute under the iManager user context. The source bundle provides no CVSS, CWE, or exploit-detail evidence.
Likely exposure
Organizations running affected NetIQ Access Manager 4.1 or 4.2 deployments with iManager available to logged-in remote users are the likely exposure group. Exposure depends on whether the certificate upload feature and iManager access are reachable by users beyond trusted administrators.
Exploitation context
The cited CVE text supports authenticated remote code execution, not unauthenticated exploitation. CISA KEV status is false in the bundle, and no cited source states active exploitation or public weaponization. Treat exploitation evidence as incomplete.
Researcher notes
The public bundle gives a concise vulnerability statement and affected version boundaries, but lacks CVSS, CWE, detailed prerequisites, and vendor advisory text. Do not assume affected products beyond NetIQ Access Manager iManager releases named in the description.
Mitigation direction
- Upgrade 4.1 deployments to 4.1.2 Hot Fix 1 or later.
- Upgrade 4.2 deployments to 4.2.2 or later.
- Review Novell KB 7017807 for vendor-specific deployment guidance.
- Restrict iManager access to trusted administrative users and networks.
- Audit who can log in and use certificate upload workflows.
Validation and detection
- Inventory NetIQ Access Manager and iManager versions in production.
- Confirm whether any 4.1 version is below 4.1.2 Hot Fix 1.
- Confirm whether any 4.2 version is below 4.2.2.
- Check whether iManager is reachable from untrusted networks.
- Review logs for unexpected certificate uploads or JSP artifacts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2016-5750 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.novell.com/support/kb/doc.php?id=7017807CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.