CVE-2016-9498

CVE-2016-9498 is a critical deserialization vulnerability affecting ManageEngine Applications Manager versions 12 and 13 prior to build 13200. This flaw allows an unauthenticated remote attacker to execute arbitrary code with system administrator privileges on the underlying operating system. With a CVSS score of 9.8, the vulnerability presents a severe risk due to its network-based attack vector, low complexity, and complete compromise potential for confidentiality, integrity, and availability. While there is no public exploit code or active exploitation reported, and minimal community discussion, its high EPSS and FAUCET Risk Score indicate a significant theoretical threat.