ManageEngine M365 Manager Plus vulnerable to critical privilege escalation

A critical vulnerability, CVE‑2026‑12591, was identified in ManageEngine’s M365 Manager Plus. The NVD record lists a CVSS score of 9.9 and notes that any version below 4818 is affected, with a patch available in the 4818 release. The vendor advisory confirms the same affected range and provides the fixed version. No public exploitation or proof‑of‑concepts were reported during the 48‑hour window, and the CISA KEV catalog does not list this CVE, indicating no confirmed attacks yet. Organizations using M365 Manager Plus should immediately apply the 4818 patch and verify that only trusted users have delegated admin rights. Regularly monitor the KEV catalog for updates and keep the product up‑to‑date to mitigate this high‑risk flaw. See the NVD record for details and the vendor advisory for patch instructions.