Read the docs

Zohocorp

Records612All Threatist records
Exploited (KEV)9In CISA KEV
CVSS critical152CVSS 9.0–10.0
CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV
TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Priority CRITICAL 89KEV 2023-03-07TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2023-01-23TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-09-22TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2021-12-10TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2021-12-01TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records
Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

8 records in Manageengine Endpoint Central · all components

TI-2024-26074 CVE-2024-38868 · GHSA-fcrv-q4xw-6crp

Incorrect authorization in ManageEngine Endpoint Central

Priority LOW 37

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00795 Published 2024-08-30 Fixed in 11.3.2406.08, 11.3.2400.15 CWE-863
TI-2024-09463 CVE-2024-10203 · GHSA-976j-3f9q-58vp

Agent Arbitrary File Deletion

Priority LOW 36

Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00448 Published 2024-11-07 Fixed in 11.3.2416.22, 11.3.2428.10 CWE-269
TI-2025-04934 CVE-2025-5494 · GHSA-hwj5-gqwh-gh6c

Privilege escalation in Zohocorp Endpoint Central

Priority LOW 34

ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0026 Published 2025-09-25 No fix listed CWE-269
TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

Priority LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200
TI-2025-06811 CVE-2025-7473 · GHSA-4x28-f32q-r2qv

XML injection in Zohocorp Endpoint Central

Priority LOW 24

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.0034 Published 2025-10-21 No fix listed CWE-91
TI-2025-10300 CVE-2025-11248 · GHSA-8r3p-hrm4-g839

Sensitive Information Logged

Priority LOW 21

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00517 Published 2025-10-27 Fixed in 11.4.2528.05 CWE-532
TI-2024-08447 CVE-2024-9097 · GHSA-fq8v-wjfj-2725

Authorization bypass in ManageEngine Endpoint Central

Priority LOW 21

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00705 Published 2025-02-05 Fixed in 11.3.2440.09 CWE-639
TI-2025-04936 CVE-2025-5496 · GHSA-c58g-qw82-6m5x

Arbitrary File Deletion

Priority LOW 16

ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00255 Published 2025-10-21 Fixed in 11.4.2508.14, 11.4.2516.06 +1 CWE-269
Open these records in search →