Read the docs

Zohocorp

Records612All Threatist records
Exploited (KEV)9In CISA KEV
CVSS critical152CVSS 9.0–10.0
CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV
TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Priority CRITICAL 89KEV 2023-03-07TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2023-01-23TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-09-22TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2021-12-10TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2021-12-01TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records
Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

11 records in Manageengine Access Manager Plus · all components

TI-2022-23765 CVE-2022-47966 · GHSA-mqq7-v29v-25f6

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003…

Priority CRITICAL 100KEV

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT feature…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99753 Published 2023-01-18 No fix listed CWE-20
TI-2023-02149 CVE-2023-2291 · GHSA-q9gm-gx3j-8hmm

Hard-coded credentials in Zoho ManageEngine Multiple Products

Priority HIGH 69

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00808 Published 2023-04-26 No fix listed CWE-798
TI-2025-10699 CVE-2025-11669 · GHSA-6ffq-xrg2-pp92

Broken access control in Zohocorp ManageEngine PAM360

Priority LOW 39

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functional…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00786 Published 2026-01-13 Fixed in 8202, 13221 +1 CWE-862
TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

Priority LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200
Open these records in search →