CVE-2026-6516 — ManageEngine ADAudit Plus Agent API OS Command Injection (Unauthenticated RCE)¶

Key facts

CVE-2026-6516 is a Critical (10.0) vulnerability: ManageEngine ADAudit Plus Agent API OS Command Injection (Unauthenticated RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-6516
Severity	Critical (10.0)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-6516/

Details¶

CVE-2026-6516 is a Critical (10.0) vulnerability: ManageEngine ADAudit Plus Agent API OS Command Injection (Unauthenticated RCE). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.


CVSS v3	10.0 (Critical)
CWE	CWE-78 OS Command Injection
Affected	Zohocorp ManageEngine ADAudit Plus < build 8606
Fixed	build 8606
Vector	Network / Unauthenticated

For authorized security testing, CTF, and research only.

Summary¶

ADAudit Plus is affected by unauthenticated remote code execution through a vulnerable agent API: an attacker-supplied parameter is passed into an OS command without sanitization, allowing shell command injection and arbitrary code execution on the server as the ADAudit Plus service account.

Root cause¶

The agent API builds a diagnostic/OS command by concatenating a request parameter (e.g. a target host) into a shell string. Shell metacharacters (;, |, &&, backticks) in the parameter break out and run attacker commands. The fix (build 8606) authenticates the agent API and validates the parameter against a strict allowlist.

Detection (`poc.py`)¶

Non-destructive: submits a parameter that injects a benign echo <marker> command (no destructive or persistent action). If the marker is reflected in the response, the parameter reaches a shell unsanitized → VULNERABLE. The PoC never runs destructive commands.

python poc.py --target http://TARGET:5005

Lab¶

docker compose up --build      # vulnerable on :5005, patched on :5006
./run-tests.sh

Remediation¶

Update ADAudit Plus to build 8606+.
Authenticate the agent API; validate host/target parameters against a strict allowlist (no shell metacharacters).
Apply prevention/ to block command-injection payloads on the agent API.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-6516, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-6516 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2026-6516 — ADAudit Plus agent API OS command injection (Snort/Suricata)

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-6516 ADAudit Plus agent API command injection"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/api/agent/"; \
    http.request_body; pcre:"/[;|`]|&&|\x24\(|\|\||\/bin\/(sh|bash)|\bnc\b/i"; \
    classtype:web-application-attack; sid:2026006516; rev:1; )

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-6516 — ADAudit Plus agent API OS command injection
 * Detect captured agent-API command-injection payloads / dropped shells.
 */

rule CVE_2026_6516_adaudit_cmd_injection
{
    meta:
        cve = "CVE-2026-6516"
        description = "ADAudit Plus agent API OS command-injection payload"
        severity = "critical"
    strings:
        $api = "/api/agent/execute" ascii
        $t = "\"target\"" ascii
        $c1 = "; echo" ascii nocase
        $c2 = "/bin/sh" ascii
        $c3 = "/bin/bash" ascii
        $c4 = "$(“" ascii
        $c5 = "powershell" ascii nocase
    condition:
        ($api or $t) and any of ($c1, $c2, $c3, $c4, $c5)
}

:material-file-download: prevention/yara.yar

# CVE-2026-6516 — ADAudit Plus agent API OS command injection
# Restrict the agent API and block shell metacharacters in its parameters.

location /api/agent/ {
    # Agent API should only be reachable from managed endpoints, never the internet.
    allow 10.0.0.0/8;          # <- adjust to agent subnet
    deny  all;

    # Block command-injection metacharacters in the request body.
    if ($request_body ~* "([;|`]|&&|\$\(|\|\||\bnc\b|/bin/)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:5005;
    proxy_set_header Host $host;
    client_body_in_single_buffer on;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-6516 — ADAudit Plus agent API OS command injection (Apache + ModSecurity)

# Restrict the agent API to the managed agent subnet.
<LocationMatch "^/api/agent/">
    Require ip 127.0.0.1 10.0.0.0/8    # <- adjust
</LocationMatch>

# Block shell metacharacters in agent API parameters.
SecRule REQUEST_URI "@beginsWith /api/agent/" \
    "id:2026006516,phase:2,deny,status:403,log,\
     msg:'CVE-2026-6516 ADAudit Plus agent API command injection',chain"
    SecRule REQUEST_BODY|ARGS "@rx [;|`]|&&|\$\(|\|\||/bin/(sh|bash)|\bnc\b" "t:none,t:urlDecodeUni"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-6516?¶

CVE-2026-6516 is a Critical (10.0) vulnerability: ManageEngine ADAudit Plus Agent API OS Command Injection (Unauthenticated RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-6516?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-6516?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.