Sensitive Info Log: ZMEC <11.4.2528.05 Logs Agent Token (CVE-2025-11248)
CVE-2025-11248 Published on October 27, 2025
Sensitive Information Logged
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
Vulnerability Analysis
CVE-2025-11248 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Products Associated with CVE-2025-11248
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-11248 are published in Zoho Corp Manageengine Endpoint Central:
Affected Versions
Zohocorp ManageEngine Endpoint Central:- Before 11.4.2528.05 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.