CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

• CWE-264

• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jan/2Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/534356/100/0/threaded
• http://www.securityfocus.com/bid/71849Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txtThird Party Advisory
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.htmlThird Party Advisory
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_adminExploit, Third Party Advisory
• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jan/2Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/534356/100/0/threaded
• http://www.securityfocus.com/bid/71849Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txtThird Party Advisory
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.htmlThird Party Advisory
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_adminExploit, Third Party Advisory

Published

Jan 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7856Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7857D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.0…
• CVE-2014-7858The check_login function in D-Link DNR-326 before 2.10 build…
• CVE-2014-7859Stack-based buffer overflow in login_mgr.cgi in D-Link firmw…
• CVE-2014-7860The web/web_file/fb_publish.php script in D-Link DNS-320L be…
• CVE-2014-7861The IOHIDSecurePromptClient function in Apple OS X does not …
• CVE-2014-7863The FailOverHelperServlet (aka FailServlet) servlet in ZOHO …7.5
• CVE-2014-7864Multiple SQL injection vulnerabilities in the FailOverHelper…
• CVE-2014-7865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-7866Multiple directory traversal vulnerabilities in ZOHO ManageE…
• CVE-2014-7867SQL injection vulnerability in the com.manageengine.opmanage…
• CVE-2014-7868Multiple SQL injection vulnerabilities in ZOHO ManageEngine …