EIP-2026-104322

PRE-CVE

ManageEngine Desktop Central - 'FileStorage getChartImage' Deserialization / Unauthenticated Remote Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104322. PoCs published by mr_me.

AI-analyzed exploit summary This is a detailed technical analysis of a deserialization vulnerability in ManageEngine Desktop Central, specifically in the CewolfServlet and MDMLogUploaderServlet components. The writeup explains how an unauthenticated attacker can achieve remote code execution by exploiting uncontrolled deserialization of attacker-controlled data.

Description

ManageEngine Desktop Central - 'FileStorage getChartImage' Deserialization / Unauthenticated Remote Code Execution

Exploits (1)

exploitdb WRITEUP
by mr_me · pythonwebappsmultiple
https://www.exploit-db.com/exploits/48176

This is a detailed technical analysis of a deserialization vulnerability in ManageEngine Desktop Central, specifically in the CewolfServlet and MDMLogUploaderServlet components. The writeup explains how an unauthenticated attacker can achieve remote code execution by exploiting uncontrolled deserialization of attacker-controlled data.

Classification
Writeup 100%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: ManageEngine Desktop Central (version not specified, but SHA1 provided for a specific build)
No auth needed
Prerequisites: Network access to the target server · Ability to send HTTP requests to the vulnerable endpoints
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026