Read the docs
TI-2014-06533 Aliases CVE-2014-7863GHSA-cc9f-r47w-qj8f

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications…

Priority HIGH 74CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Why it matters now

EPSS 0.83399 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*up to 11.9VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_it360:*:*:*:*:*:*:*:*up to 10.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*8 – 11.5VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* Versions up to 11.9 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_it360:*:*:*:*:*:*:*:* Versions up to 10.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions 8 – 11.5 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-7863
  2. 2026-10-03 Alias added: GHSA-cc9f-r47w-qj8f

References

Exploit 3

Other 1

  • TI-2018-05713 A remote code execution issue was discovered in Zoho ManageEngine Applications Manager… CVSS 3.0CRITICAL 9.8
  • TI-2023-12889 Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager… CVSS 3.1MEDIUM 6.1
  • TI-2018-09364 A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x… CVSS 3.0CRITICAL 9.8
  • TI-2020-12793 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
  • TI-2020-12540 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
  • TI-2021-11810 Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while… CVSS 3.1MEDIUM 5.4
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences