What is the CVSS score of CVE-2025-3835?

CVE-2025-3835 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of Zoho are affected by CVE-2025-3835?

ManageEngine Exchange Reporter Plus versions 5721 and prior contain a critical unauthenticated remote code execution vulnerability in the Content Search module that allows attackers to execute…. A patch is available.

How to fix or mitigate CVE-2025-3835?

Within 24 hours: Identify all Exchange Reporter Plus instances running version 5721 or earlier and isolate from production networks if patching cannot be completed immediately. Within 7 days: Apply vendor-released patch to upgrade all affected instances to version 5722 or later, per vendor advisory. Within 30 days: Conduct forensic analysis of access logs to the Content Search module from the past 90 days to identify potential exploitation attempts; review email data integrity and access controls.

Zoho CVE-2025-3835

EUVD-2025-17446 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-09 0fc0942c-577d-436f-ae8e-945763c79b02

Zoho Exchange RCE Manageengine Exchange Reporter Plus

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:55 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5722

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17446

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 11:15 nvd

CRITICAL 9.6

DescriptionCVE.org

Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.

AnalysisAI

Critical remote code execution vulnerability in Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior, exploitable through the Content Search module without authentication. An attacker can achieve arbitrary code execution with high confidentiality, integrity, and availability impact across the system boundary (CVSS 9.6). This vulnerability requires user interaction (UI=R) and involves improper file upload handling (CWE-434); active exploitation status and POC availability require verification through CISA KEV and public disclosures.

Technical ContextAI

CVE-2025-3835 stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a classic file upload vulnerability where the Content Search module in ManageEngine Exchange Reporter Plus fails to properly validate or restrict uploaded file types. The vulnerability likely exists in the web-facing search functionality that processes user-submitted content without adequate input validation, allowing attackers to upload and execute arbitrary files (potentially executable code, web shells, or scripts) on the server. Exchange Reporter Plus is ManageEngine's reporting and analytics solution for Microsoft Exchange environments, making the Content Search module a critical interface. The affected product CPE would be: cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* with version constraint <=5721. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), but requires user interaction (UI:R), suggesting a social engineering or victim-initiated upload component.

RemediationAI

Immediate remediation steps: (1) Identify and inventory all ManageEngine Exchange Reporter Plus installations, noting version numbers; (2) Upgrade to the latest patched version released by Zohocorp (expected to be >5721; confirm via Zohocorp security bulletins at https://www.manageengine.com/security or vendor communications); (3) If immediate patching is not feasible, implement compensating controls: (a) Restrict network access to the Exchange Reporter Plus UI using firewall rules or VPN authentication, (b) Disable or restrict the Content Search module if operationally acceptable, (c) Monitor uploaded files and Content Search activity logs for suspicious patterns, (d) Apply principle of least privilege to service accounts; (4) Review access logs for evidence of prior exploitation; (5) Monitor Zohocorp's official security advisory pages and CISA alerts for patch release announcements and detailed remediation guidance; (6) Test patches in a non-production environment before enterprise rollout.