Zoho
Monthly
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated PowerShell command injection in ManageEngine DDI Central (versions below 6201) allows a low-privileged user to achieve remote code execution by embedding malicious content in DNS SPF/TXT records that the product pushes to a managed Windows DNS server. The flaw is network-reachable and low-complexity (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring only a valid low-privilege account and an active Windows DNS integration; no user interaction is needed once the poisoned record is pushed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Command injection in the Windows DNS Query Resolution Policy name field of ManageEngine DDI Central versions below 6201 enables an authenticated high-privilege administrator to run arbitrary operating-system commands, resulting in remote code execution on the DDI Central host. The CVSS 3.1 vector (7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack that nonetheless requires privileged console access and the ability to create or edit a Windows DNS Query Resolution Policy, and no public exploit has been identified at time of analysis. The vulnerability is fixed in version 6201, so affected deployments that manage Windows DNS should be prioritized for upgrade, especially since a successful exploit yields full confidentiality, integrity, and availability impact on the compromised server.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
Authenticated OS command injection in Zoho ManageEngine OpManager MSP 12.8.709 and below allows an attacker holding any valid low-privilege console account to execute arbitrary operating system commands on the server through the Notification Profile module, with no user interaction required. Exploitation yields full compromise of confidentiality, integrity and availability of the OpManager host, which for an MSP deployment typically means access to monitored customer infrastructure. The vendor rates the issue 9.9 (scope-changed); our independent assessment places it at high severity with unchanged scope, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in environments where operator or tenant accounts are widely provisioned or reusable.
Authentication bypass in Zoho ManageEngine OpManager 12.8.710 and earlier allows an attacker reaching the web console to skip an authentication control when the optional Application Manager Plugin is enabled, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Only instances with that specific non-default add-on are exposed; deployments without the plugin are not affected. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the CWE-306 missing-authentication root cause means the precondition is worth treating as near-unauthenticated until the vendor advisory clarifies it.
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
SQL injection in the Rule Management Search Reports feature of ManageEngine OpManager and Firewall Analyzer 12.8.669 and earlier allows a remote, authenticated low-privilege user to inject arbitrary SQL through a search parameter, giving them database read and write capability with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is rated CVSS 8.8 and affects on-premises ITOM deployments exposing the web console; exploitation requires prior possession of valid credentials at any privilege tier, so it is not a pre-authentication flaw. At time of analysis there is no public exploit identified and no confirmed active exploitation, but the vendor has released a patch in version 12.8.670, making upgrade the decisive remediation step.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Missing authentication in the ManageEngine ADSelfService Plus REST API (all builds before 7001) lets remote, unauthenticated attackers reach API functionality that should require a valid session or credential, as classified under CWE-306. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (8.6), meaning no credentials and no user interaction are needed, with the highest rated component being availability impact and more limited confidentiality/integrity effects - the exact reachable endpoints are not disclosed in the vendor advisory. No public exploit code and no confirmed active exploitation were identified at time of analysis, so EPSS/KEV signals cannot be used to prioritize this; risk is driven by internet-exposed instances of a pre-7001 build, and patching to build 7001 removes the exposure entirely.
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate.
Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not on CISA KEV, though CISA's SSVC framework rates the flaw as fully automatable with total technical impact.
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Remote code execution in Zohocorp ManageEngine ADAudit Plus (all builds before 8606) allows unauthenticated attackers to run arbitrary OS commands by abusing the product's agent API, which fails to sanitize input passed to a shell (CWE-78). Rated CVSS 10.0 by the vendor with a scope-changing vector, the flaw requires no privileges or user interaction and reaches the network-exposed agent communication channel directly. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity and unauthenticated nature make it a high-priority patch for any exposed deployment.
Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control.
Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory.
Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis.
Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data.
SQL injection in Zohocorp ManageEngine PAM360 (before build 8531) and Password Manager Pro (builds 8600 through 13230) lets an authenticated attacker inject arbitrary SQL through the query report module, enabling extraction and modification of privileged-vault data. Because these products are enterprise password/privileged-access managers, a successful injection can expose stored credentials and secrets for an entire environment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and a vendor patch is available.
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionality due to use of a vulnerable Apache XML Security library, massively exploited in January 2023.
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.2%.
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.6%.
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.5%.
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.7%.
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.2%.
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.6%.
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.8%.
Insufficient driver signature validation in the MEARWService component of Zoho Corp's ManageEngine Malware Protection Plus (all versions before 1.0.64.12) allows an attacker who already holds administrative rights on the endpoint and has local or physical access to load a driver that the service fails to validate. Successful abuse can extend beyond the service into the kernel, yielding high confidentiality, integrity, and availability impact (scope-changed), though the AV:P/PR:H vendor vector and the need for pre-existing admin plus physical presence keep this a low-to-moderate real-world priority. The issue is patched in 1.0.64.12, no public exploit code has been identified, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis.
Malformed syslog packets can crash the log collector in ManageEngine EventLog Analyzer and Log360 builds prior to 13071, causing a denial of service against the log ingestion pipeline. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) because syslog reception is a default, always-on function of both products; there is no public exploit identified at time of analysis, and impact is confined to availability (A:L) with no confidentiality, integrity, or code-execution effect. Exposure is greatest where the syslog listener is reachable from an untrusted network segment, while collectors restricted to trusted internal sources carry substantially lower risk.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
Time-based blind SQL injection in the Catalyst Connect Zoho CRM Client Portal WordPress plugin (all versions ≤ 2.2.0) enables authenticated administrators to exfiltrate arbitrary data from the underlying WordPress database via the unsanitized 'uid' parameter. The CVSS vector (PR:H) confirms exploitation requires administrator-level credentials, meaningfully constraining the attack surface. A public proof-of-concept is available on GitHub (BFS-Lab/BFSDV), and no confirmed patch version has been identified in available intelligence at time of analysis.
Cross-site request forgery in the Zoho Mail WordPress plugin (all versions before 1.6.2) enables a remote attacker to perform unauthorized, integrity-impacting actions on behalf of an authenticated WordPress user without their knowledge. The CVSS 5.7 medium score reflects high integrity impact with no confidentiality or availability exposure, requiring low-privilege victim authentication and user interaction. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 1st percentile and SSVC classifies exploitation status as none.
Stored cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (pre-5802) allows authenticated attackers to inject malicious scripts via the Permissions Based on Mailboxes report, potentially compromising administrator sessions and stealing high-privilege credentials. Attack requires low complexity and user interaction from a victim administrator. CVSS 7.3 (High) reflects significant confidentiality and integrity impact. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed vulnerability.
Stored cross-site scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus versions prior to 5802 allows authenticated attackers to inject malicious scripts through the Non-Owner Mailbox Permission report, potentially compromising confidentiality and integrity of user sessions. With CVSS 7.3 (High) and EPSS data unavailable, exploitation requires low attack complexity and authenticated access with user interaction. No public exploit identified at time of analysis, and vendor has released patched version 5802.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers to inject malicious scripts via the Folder Message Count and Size report. With CVSS 7.3 (High severity) and requiring low-privilege authentication with user interaction, successful exploitation enables session hijacking and credential theft within the administrative interface. No public exploit identified at time of analysis, though CVSS vector indicates network-accessible attack surface with low complexity.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers to inject malicious scripts through the Public Folder Client Permissions report, enabling session hijacking and credential theft with medium exploitation complexity. No active exploitation confirmed (not present in CISA KEV), though the network-accessible attack vector and stored nature of the XSS elevate real-world risk for organizations using this Exchange monitoring solution.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers with low privileges to inject malicious scripts into Equipment Mailbox Details reports, enabling session hijacking and credential theft against administrative users who view the poisoned reports. No active exploitation confirmed (not in CISA KEV), but the vulnerability affects organizations monitoring Microsoft Exchange environments through ManageEngine's reporting platform.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers to inject malicious scripts into the 'Mails Exchanged Between Users' report. With CVSS 7.3 (High severity) and low attack complexity (AC:L), this vulnerability requires low-privilege authentication (PR:L) and user interaction (UI:R) to achieve high confidentiality and integrity impact. No public exploit identified at time of analysis, though authentication requirements lower the barrier for insider threats or compromised accounts.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers with low privileges to inject malicious scripts into the Permissions based on Distribution Groups report, potentially leading to session hijacking and account compromise of administrators viewing the report. No active exploitation confirmed (CISA KEV absent), but the network-accessible attack vector and low complexity make this exploitable with publicly documented vendor advisory details.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus versions prior to 5802 allows authenticated attackers with low privileges to inject malicious scripts into Distribution Lists reports that execute when viewed by other users, potentially compromising session tokens and account credentials of administrators or other privileged users. The vulnerability requires user interaction (victim must view the malicious report) but enables high-impact attacks against confidentiality and integrity within the application scope. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in the NOC view of Zoho ManageEngine Applications Manager affects all builds up to and including 177400 and lets an authenticated user who can write or configure NOC view content plant a persistent script that runs in the browser of any user who subsequently opens that dashboard. Exploitation is not remote-unauthenticated: it requires the attacker to hold a session with privileges that allow content/configuration writes in the NOC view, and it depends on a second user rendering the poisoned view, so the practical impact is privilege-limited and victim-interaction dependent. No public exploit code has been identified at time of analysis, the EPSS score is low (1.10%, ~64th percentile), and the vendor has published a fix; only versions 177400 and below are affected.
NTLM hash exposure in Zoho ManageEngine ADManager Plus builds prior to 8025 allows an authenticated technician account that has the non-default 'Impersonate as Admin' delegation option enabled to obtain NTLM credential material that the application should retain internally. The flaw is scoped as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (base 4.3), so exploitation requires a valid low-privileged technician login plus that specific feature gate, sharply limiting the reachable attacker population to already-trusted privileged operators; confidentiality impact is limited and there is no integrity or availability effect. No public exploit code has been identified at time of analysis, and EPSS is low at 0.44% (36th percentile), making this a low-to-moderate risk issue rather than an urgent, actively exploited threat.
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus before build 5723 allows an authenticated low-privileged user to inject persistent JavaScript into the reports module, which executes in another user's browser when that user views the poisoned report. The vendor has released build 5723 as the fix, and no public exploit identified at time of analysis; EPSS is low at 0.45% (37th percentile), consistent with a moderate, not urgent, priority.
Stored cross-site scripting in Zoho ManageEngine Exchange Reporter Plus (all builds through 5721) lets an authenticated user of the web console inject malicious script into the Instant Search feature, where it is persisted and later executed in the browser of any other user who views the poisoned search output. Exploitation is rated medium severity (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because it requires valid console credentials and a separate victim who interacts with the stored content; the scope-changed rating reflects that the payload runs in the victim's browser session rather than the attacker's. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS is low at 0.45% (37th percentile), so this should be treated as a routine patch item rather than an emergency.
Authenticated users of Zoho ManageEngine Exchange Reporter Plus (version 5.7 and all builds through 5721) can exhaust server CPU and hang the application's search module by submitting crafted search input that triggers catastrophic regular-expression backtracking. The flaw is a classic ReDoS (CWE-400, uncontrolled resource consumption) rated CVSS 6.5, with impact confined to availability - there is no loss of confidentiality or integrity - and exploitation requires a valid low-privilege account (PR:L) plus network reachability to the web interface. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS is 1.14% (66th percentile), indicating low-but-nonzero predicted exploitation activity, making this a moderate rather than top-tier priority.
ManageEngine Endpoint Central versions prior to 11.4.2528.05 log a sensitive agent token, allowing an authenticated user with access to the product's logs to recover that token. Exploitation requires a valid authenticated account and the ability to read or export logs (CVSS PR:L); no public exploit identified at time of analysis, and EPSS is 0.52% (low). This is a moderate-severity information disclosure issue (CVSS 4.3) fixed in 11.4.2528.05.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
Information disclosure in Zoho ManageEngine Applications Manager 17.6 (build 176800 and below) allows an authenticated, low-privileged user to read sensitive file and directory contents through the product's File/Directory monitor feature. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact but no integrity or availability effect, meaning it exposes data rather than enabling modification or denial of service. Exploitation requires a valid console session and access to the monitor feature; no public exploit code has been identified at time of analysis, no KEV listing exists, and EPSS is low at 0.96% (60th percentile), so risk is moderate and concentrated in environments that leave the management console broadly reachable with shared or loosely scoped accounts.
Authenticated command injection in Zoho ManageEngine ADManager Plus allows a logged-in user who can reach the Custom Script component to inject operating system commands that execute on the server. Affected instances are those running builds earlier than 8024 (CPE entries cover 8.0 builds 8001 through 8023), and exploitation requires valid credentials plus sufficient role privileges to access the Custom Script automation feature (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8). There is no public exploit identified at time of analysis and no CISA KEV listing, though an EPSS score of 4.54% (91st percentile) indicates above-average predicted exploitation activity; the underlying weakness is CWE-77 command injection.
Authenticated SQL injection in Zoho ManageEngine Analytics Plus 6.1 (builds 6100 through 6171 and earlier) allows any low-privileged user with network access to the application's 'key update API' to inject arbitrary SQL and read or modify the underlying database, with high impact to confidentiality, integrity and availability (CVSS 8.8, PR:L). The attack is network-based with low complexity and no user interaction, but the authentication requirement (verified from the CVSS vector PR:L) means an attacker must already hold valid credentials - obtained directly, through weak credential hygiene, credential reuse, or phishing - so unauthenticated internet-wide exploitation is not possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the EPSS score of 27.38% (98th percentile) signals an elevated predicted likelihood of exploitation activity, making this a genuine priority rather than a high-CVSS-but-low-risk finding.
XML injection in Zoho ManageEngine EndPoint Central versions 11.4.2516.1 and prior allows an authenticated attacker with local access to inject malicious XML content, leading to low-level impacts on confidentiality, integrity, and availability. The vulnerability requires a low-privileged account and local access (CVSS vector AV:L/PR:L), and there is no public exploit identified at time of analysis. EPSS score is 0.34% (25th percentile), indicating low real-world exploitation likelihood, and no CISA KEV status is present.
Local privilege escalation in Zoho ManageEngine Endpoint Central is possible through an arbitrary file deletion flaw in the agent setup component, letting an attacker who already holds a low-privileged local foothold delete files of their choosing - including files that the higher-privileged agent service depends on - on hosts running agent builds earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. The attack is strictly local (CVSS AV:L) and requires an authenticated low-privilege account (PR:L) with no victim interaction (UI:N), which caps both severity and reachability; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV, making this a low-priority finding that is nonetheless worth patching during routine agent maintenance.
Stored cross-site scripting can be injected into W3SCloud Contact Form 7 to Zoho CRM plugin for WordPress (versions through 3.0) via CSRF attack, allowing unauthenticated remote attackers to execute malicious JavaScript in administrator sessions when admins are tricked into visiting attacker-controlled pages. The vulnerability chains CSRF (CWE-352) with stored XSS, enabling privilege escalation from no access to stored administrative malicious code. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated PowerShell command injection in ManageEngine DDI Central (versions below 6201) allows a low-privileged user to achieve remote code execution by embedding malicious content in DNS SPF/TXT records that the product pushes to a managed Windows DNS server. The flaw is network-reachable and low-complexity (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring only a valid low-privilege account and an active Windows DNS integration; no user interaction is needed once the poisoned record is pushed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Command injection in the Windows DNS Query Resolution Policy name field of ManageEngine DDI Central versions below 6201 enables an authenticated high-privilege administrator to run arbitrary operating-system commands, resulting in remote code execution on the DDI Central host. The CVSS 3.1 vector (7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack that nonetheless requires privileged console access and the ability to create or edit a Windows DNS Query Resolution Policy, and no public exploit has been identified at time of analysis. The vulnerability is fixed in version 6201, so affected deployments that manage Windows DNS should be prioritized for upgrade, especially since a successful exploit yields full confidentiality, integrity, and availability impact on the compromised server.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.
Privilege escalation in ZohoCorp ManageEngine Applications Manager 182000 and earlier allows a holder of an authenticated low-privileged account to read an administrator's API key and then replay that key to carry out administrator-level actions over the network. Exploitation requires a valid low-privilege login (CVSS vector PR:L) on a vulnerable instance, but needs no user interaction and no special configuration, and successful abuse grants full high-integrity, high-confidentiality control of the application. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary limiting factor is the mandatory pre-existing low-privilege account, which is why this rates as a genuine high-priority flaw rather than a benign high-CVSS artifact.
SQL injection in ManageEngine Applications Manager (builds 182000 and below) allows an authenticated low-privileged user to run arbitrary SQL commands against the application's database, enabling escalation to administrator privileges and, from there, remote code execution on the underlying host. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is rated high priority because the only meaningful barrier is possession of any valid low-privileged account - no user interaction or special configuration is required, and once credentials exist the attack complexity is low. Exploitation status: no public exploit identified at time of analysis; the issue was reported by the vendor (Zohocorp), and no CISA KEV listing or public proof-of-concept code has been observed in the supplied intelligence.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
ManageEngine Applications Manager builds 182200 and below embed a static Google Cloud service-account private key inside the shipped installer, so anyone who downloads that installer artifact can extract the credential without authenticating to the product and then impersonate the service account directly against Google Cloud APIs. The vendor scores this CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) because the leaked key grants high confidentiality and integrity impact on associated cloud resources and the scope changes beyond the Applications Manager instance itself, with no authentication or user interaction required. Exploitation depends on the installer being obtainable and the referenced service account remaining active with meaningful IAM permissions; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the credential is static rather than runtime-dependent, which makes the exposure durable rather than conditional.
Authenticated OS command injection in Zoho ManageEngine OpManager MSP 12.8.709 and below allows an attacker holding any valid low-privilege console account to execute arbitrary operating system commands on the server through the Notification Profile module, with no user interaction required. Exploitation yields full compromise of confidentiality, integrity and availability of the OpManager host, which for an MSP deployment typically means access to monitored customer infrastructure. The vendor rates the issue 9.9 (scope-changed); our independent assessment places it at high severity with unchanged scope, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in environments where operator or tenant accounts are widely provisioned or reusable.
Authentication bypass in Zoho ManageEngine OpManager 12.8.710 and earlier allows an attacker reaching the web console to skip an authentication control when the optional Application Manager Plugin is enabled, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Only instances with that specific non-default add-on are exposed; deployments without the plugin are not affected. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the CWE-306 missing-authentication root cause means the precondition is worth treating as near-unauthenticated until the vendor advisory clarifies it.
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
SQL injection in the Rule Management Search Reports feature of ManageEngine OpManager and Firewall Analyzer 12.8.669 and earlier allows a remote, authenticated low-privilege user to inject arbitrary SQL through a search parameter, giving them database read and write capability with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is rated CVSS 8.8 and affects on-premises ITOM deployments exposing the web console; exploitation requires prior possession of valid credentials at any privilege tier, so it is not a pre-authentication flaw. At time of analysis there is no public exploit identified and no confirmed active exploitation, but the vendor has released a patch in version 12.8.670, making upgrade the decisive remediation step.
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Missing authentication in the ManageEngine ADSelfService Plus REST API (all builds before 7001) lets remote, unauthenticated attackers reach API functionality that should require a valid session or credential, as classified under CWE-306. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (8.6), meaning no credentials and no user interaction are needed, with the highest rated component being availability impact and more limited confidentiality/integrity effects - the exact reachable endpoints are not disclosed in the vendor advisory. No public exploit code and no confirmed active exploitation were identified at time of analysis, so EPSS/KEV signals cannot be used to prioritize this; risk is driven by internet-exposed instances of a pre-7001 build, and patching to build 7001 removes the exposure entirely.
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate.
Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not on CISA KEV, though CISA's SSVC framework rates the flaw as fully automatable with total technical impact.
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Remote code execution in Zohocorp ManageEngine ADAudit Plus (all builds before 8606) allows unauthenticated attackers to run arbitrary OS commands by abusing the product's agent API, which fails to sanitize input passed to a shell (CWE-78). Rated CVSS 10.0 by the vendor with a scope-changing vector, the flaw requires no privileges or user interaction and reaches the network-exposed agent communication channel directly. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity and unauthenticated nature make it a high-priority patch for any exposed deployment.
Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control.
Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory.
Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis.
Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data.
SQL injection in Zohocorp ManageEngine PAM360 (before build 8531) and Password Manager Pro (builds 8600 through 13230) lets an authenticated attacker inject arbitrary SQL through the query report module, enabling extraction and modification of privileged-vault data. Because these products are enterprise password/privileged-access managers, a successful injection can expose stored credentials and secrets for an entire environment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and a vendor patch is available.
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionality due to use of a vulnerable Apache XML Security library, massively exploited in January 2023.
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.2%.
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.6%.
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.5%.
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.7%.
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.2%.
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.6%.
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.8%.
Insufficient driver signature validation in the MEARWService component of Zoho Corp's ManageEngine Malware Protection Plus (all versions before 1.0.64.12) allows an attacker who already holds administrative rights on the endpoint and has local or physical access to load a driver that the service fails to validate. Successful abuse can extend beyond the service into the kernel, yielding high confidentiality, integrity, and availability impact (scope-changed), though the AV:P/PR:H vendor vector and the need for pre-existing admin plus physical presence keep this a low-to-moderate real-world priority. The issue is patched in 1.0.64.12, no public exploit code has been identified, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis.
Malformed syslog packets can crash the log collector in ManageEngine EventLog Analyzer and Log360 builds prior to 13071, causing a denial of service against the log ingestion pipeline. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) because syslog reception is a default, always-on function of both products; there is no public exploit identified at time of analysis, and impact is confined to availability (A:L) with no confidentiality, integrity, or code-execution effect. Exposure is greatest where the syslog listener is reachable from an untrusted network segment, while collectors restricted to trusted internal sources carry substantially lower risk.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
Time-based blind SQL injection in the Catalyst Connect Zoho CRM Client Portal WordPress plugin (all versions ≤ 2.2.0) enables authenticated administrators to exfiltrate arbitrary data from the underlying WordPress database via the unsanitized 'uid' parameter. The CVSS vector (PR:H) confirms exploitation requires administrator-level credentials, meaningfully constraining the attack surface. A public proof-of-concept is available on GitHub (BFS-Lab/BFSDV), and no confirmed patch version has been identified in available intelligence at time of analysis.
Cross-site request forgery in the Zoho Mail WordPress plugin (all versions before 1.6.2) enables a remote attacker to perform unauthorized, integrity-impacting actions on behalf of an authenticated WordPress user without their knowledge. The CVSS 5.7 medium score reflects high integrity impact with no confidentiality or availability exposure, requiring low-privilege victim authentication and user interaction. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 1st percentile and SSVC classifies exploitation status as none.
Stored cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (pre-5802) allows authenticated attackers to inject malicious scripts via the Permissions Based on Mailboxes report, potentially compromising administrator sessions and stealing high-privilege credentials. Attack requires low complexity and user interaction from a victim administrator. CVSS 7.3 (High) reflects significant confidentiality and integrity impact. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed vulnerability.
Stored cross-site scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus versions prior to 5802 allows authenticated attackers to inject malicious scripts through the Non-Owner Mailbox Permission report, potentially compromising confidentiality and integrity of user sessions. With CVSS 7.3 (High) and EPSS data unavailable, exploitation requires low attack complexity and authenticated access with user interaction. No public exploit identified at time of analysis, and vendor has released patched version 5802.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers to inject malicious scripts via the Folder Message Count and Size report. With CVSS 7.3 (High severity) and requiring low-privilege authentication with user interaction, successful exploitation enables session hijacking and credential theft within the administrative interface. No public exploit identified at time of analysis, though CVSS vector indicates network-accessible attack surface with low complexity.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers to inject malicious scripts through the Public Folder Client Permissions report, enabling session hijacking and credential theft with medium exploitation complexity. No active exploitation confirmed (not present in CISA KEV), though the network-accessible attack vector and stored nature of the XSS elevate real-world risk for organizations using this Exchange monitoring solution.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus (versions prior to 5802) allows authenticated attackers with low privileges to inject malicious scripts into Equipment Mailbox Details reports, enabling session hijacking and credential theft against administrative users who view the poisoned reports. No active exploitation confirmed (not in CISA KEV), but the vulnerability affects organizations monitoring Microsoft Exchange environments through ManageEngine's reporting platform.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers to inject malicious scripts into the 'Mails Exchanged Between Users' report. With CVSS 7.3 (High severity) and low attack complexity (AC:L), this vulnerability requires low-privilege authentication (PR:L) and user interaction (UI:R) to achieve high confidentiality and integrity impact. No public exploit identified at time of analysis, though authentication requirements lower the barrier for insider threats or compromised accounts.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers with low privileges to inject malicious scripts into the Permissions based on Distribution Groups report, potentially leading to session hijacking and account compromise of administrators viewing the report. No active exploitation confirmed (CISA KEV absent), but the network-accessible attack vector and low complexity make this exploitable with publicly documented vendor advisory details.
Stored cross-site scripting (XSS) in ManageEngine Exchange Reporter Plus versions prior to 5802 allows authenticated attackers with low privileges to inject malicious scripts into Distribution Lists reports that execute when viewed by other users, potentially compromising session tokens and account credentials of administrators or other privileged users. The vulnerability requires user interaction (victim must view the malicious report) but enables high-impact attacks against confidentiality and integrity within the application scope. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in the NOC view of Zoho ManageEngine Applications Manager affects all builds up to and including 177400 and lets an authenticated user who can write or configure NOC view content plant a persistent script that runs in the browser of any user who subsequently opens that dashboard. Exploitation is not remote-unauthenticated: it requires the attacker to hold a session with privileges that allow content/configuration writes in the NOC view, and it depends on a second user rendering the poisoned view, so the practical impact is privilege-limited and victim-interaction dependent. No public exploit code has been identified at time of analysis, the EPSS score is low (1.10%, ~64th percentile), and the vendor has published a fix; only versions 177400 and below are affected.
NTLM hash exposure in Zoho ManageEngine ADManager Plus builds prior to 8025 allows an authenticated technician account that has the non-default 'Impersonate as Admin' delegation option enabled to obtain NTLM credential material that the application should retain internally. The flaw is scoped as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (base 4.3), so exploitation requires a valid low-privileged technician login plus that specific feature gate, sharply limiting the reachable attacker population to already-trusted privileged operators; confidentiality impact is limited and there is no integrity or availability effect. No public exploit code has been identified at time of analysis, and EPSS is low at 0.44% (36th percentile), making this a low-to-moderate risk issue rather than an urgent, actively exploited threat.
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in ManageEngine Exchange Reporter Plus before build 5723 allows an authenticated low-privileged user to inject persistent JavaScript into the reports module, which executes in another user's browser when that user views the poisoned report. The vendor has released build 5723 as the fix, and no public exploit identified at time of analysis; EPSS is low at 0.45% (37th percentile), consistent with a moderate, not urgent, priority.
Stored cross-site scripting in Zoho ManageEngine Exchange Reporter Plus (all builds through 5721) lets an authenticated user of the web console inject malicious script into the Instant Search feature, where it is persisted and later executed in the browser of any other user who views the poisoned search output. Exploitation is rated medium severity (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because it requires valid console credentials and a separate victim who interacts with the stored content; the scope-changed rating reflects that the payload runs in the victim's browser session rather than the attacker's. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS is low at 0.45% (37th percentile), so this should be treated as a routine patch item rather than an emergency.
Authenticated users of Zoho ManageEngine Exchange Reporter Plus (version 5.7 and all builds through 5721) can exhaust server CPU and hang the application's search module by submitting crafted search input that triggers catastrophic regular-expression backtracking. The flaw is a classic ReDoS (CWE-400, uncontrolled resource consumption) rated CVSS 6.5, with impact confined to availability - there is no loss of confidentiality or integrity - and exploitation requires a valid low-privilege account (PR:L) plus network reachability to the web interface. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS is 1.14% (66th percentile), indicating low-but-nonzero predicted exploitation activity, making this a moderate rather than top-tier priority.
ManageEngine Endpoint Central versions prior to 11.4.2528.05 log a sensitive agent token, allowing an authenticated user with access to the product's logs to recover that token. Exploitation requires a valid authenticated account and the ability to read or export logs (CVSS PR:L); no public exploit identified at time of analysis, and EPSS is 0.52% (low). This is a moderate-severity information disclosure issue (CVSS 4.3) fixed in 11.4.2528.05.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
Information disclosure in Zoho ManageEngine Applications Manager 17.6 (build 176800 and below) allows an authenticated, low-privileged user to read sensitive file and directory contents through the product's File/Directory monitor feature. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with high confidentiality impact but no integrity or availability effect, meaning it exposes data rather than enabling modification or denial of service. Exploitation requires a valid console session and access to the monitor feature; no public exploit code has been identified at time of analysis, no KEV listing exists, and EPSS is low at 0.96% (60th percentile), so risk is moderate and concentrated in environments that leave the management console broadly reachable with shared or loosely scoped accounts.
Authenticated command injection in Zoho ManageEngine ADManager Plus allows a logged-in user who can reach the Custom Script component to inject operating system commands that execute on the server. Affected instances are those running builds earlier than 8024 (CPE entries cover 8.0 builds 8001 through 8023), and exploitation requires valid credentials plus sufficient role privileges to access the Custom Script automation feature (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8). There is no public exploit identified at time of analysis and no CISA KEV listing, though an EPSS score of 4.54% (91st percentile) indicates above-average predicted exploitation activity; the underlying weakness is CWE-77 command injection.
Authenticated SQL injection in Zoho ManageEngine Analytics Plus 6.1 (builds 6100 through 6171 and earlier) allows any low-privileged user with network access to the application's 'key update API' to inject arbitrary SQL and read or modify the underlying database, with high impact to confidentiality, integrity and availability (CVSS 8.8, PR:L). The attack is network-based with low complexity and no user interaction, but the authentication requirement (verified from the CVSS vector PR:L) means an attacker must already hold valid credentials - obtained directly, through weak credential hygiene, credential reuse, or phishing - so unauthenticated internet-wide exploitation is not possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the EPSS score of 27.38% (98th percentile) signals an elevated predicted likelihood of exploitation activity, making this a genuine priority rather than a high-CVSS-but-low-risk finding.
XML injection in Zoho ManageEngine EndPoint Central versions 11.4.2516.1 and prior allows an authenticated attacker with local access to inject malicious XML content, leading to low-level impacts on confidentiality, integrity, and availability. The vulnerability requires a low-privileged account and local access (CVSS vector AV:L/PR:L), and there is no public exploit identified at time of analysis. EPSS score is 0.34% (25th percentile), indicating low real-world exploitation likelihood, and no CISA KEV status is present.
Local privilege escalation in Zoho ManageEngine Endpoint Central is possible through an arbitrary file deletion flaw in the agent setup component, letting an attacker who already holds a low-privileged local foothold delete files of their choosing - including files that the higher-privileged agent service depends on - on hosts running agent builds earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. The attack is strictly local (CVSS AV:L) and requires an authenticated low-privilege account (PR:L) with no victim interaction (UI:N), which caps both severity and reachability; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV, making this a low-priority finding that is nonetheless worth patching during routine agent maintenance.
Stored cross-site scripting can be injected into W3SCloud Contact Form 7 to Zoho CRM plugin for WordPress (versions through 3.0) via CSRF attack, allowing unauthenticated remote attackers to execute malicious JavaScript in administrator sessions when admins are tricked into visiting attacker-controlled pages. The vulnerability chains CSRF (CWE-352) with stored XSS, enabling privilege escalation from no access to stored administrative malicious code. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.