Read the docs
TI-2020-09246 Aliases CVE-2020-11527GHSA-x3qp-94wv-26rv

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can…

Priority MEDIUM 45Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.

Why it matters now

EPSS 0.09476 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 55

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*before 12.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:*12.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:*12.4 build124000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:*12.4 build124011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:*12.4 build124012VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:*12.4 build124013VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:*12.4 build124014VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:*12.4 build124015VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:*12.4 build124016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:*12.4 build124022VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions before 12.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:* Versions 12.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:* Versions 12.4 build124000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:* Versions 12.4 build124011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:* Versions 12.4 build124012 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:* Versions 12.4 build124013 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:* Versions 12.4 build124014 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:* Versions 12.4 build124015 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:* Versions 12.4 build124016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:* Versions 12.4 build124022 Vulnerable ·Zohocorp
Show 45 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:*12.4 build124023VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:*12.4 build124024VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:*12.4 build124025VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:*12.4 build124026VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:*12.4 build124027VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:*12.4 build124030VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:*12.4 build124033VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:*12.4 build124037VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:*12.4 build124039VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:*12.4 build124040VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:*12.4 build124041VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:*12.4 build124042VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:*12.4 build124043VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:*12.4 build124051VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:*12.4 build124053VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:*12.4 build124054VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:*12.4 build124056VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:*12.4 build124058VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:*12.4 build124065VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:*12.4 build124066VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:*12.4 build124067VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:*12.4 build124069VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:*12.4 build124070VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:*12.4 build124071VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:*12.4 build124074VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:*12.4 build124075VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:*12.4 build124081VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:*12.4 build124082VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:*12.4 build124085VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:*12.4 build124086VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:*12.4 build124087VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124089:*:*:*:*:*:*12.4 build124089VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124095:*:*:*:*:*:*12.4 build124095VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124096:*:*:*:*:*:*12.4 build124096VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124097:*:*:*:*:*:*12.4 build124097VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124098:*:*:*:*:*:*12.4 build124098VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124099:*:*:*:*:*:*12.4 build124099VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124100:*:*:*:*:*:*12.4 build124100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124101:*:*:*:*:*:*12.4 build124101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124102:*:*:*:*:*:*12.4 build124102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124168:*:*:*:*:*:*12.4 build124168VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124169:*:*:*:*:*:*12.4 build124169VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124175:*:*:*:*:*:*12.4 build124175VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124176:*:*:*:*:*:*12.4 build124176VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124178:*:*:*:*:*:*12.4 build124178VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:* Versions 12.4 build124023 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:* Versions 12.4 build124024 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:* Versions 12.4 build124025 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:* Versions 12.4 build124026 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:* Versions 12.4 build124027 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:* Versions 12.4 build124030 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:* Versions 12.4 build124033 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:* Versions 12.4 build124037 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:* Versions 12.4 build124039 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:* Versions 12.4 build124040 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:* Versions 12.4 build124041 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:* Versions 12.4 build124042 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:* Versions 12.4 build124043 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:* Versions 12.4 build124051 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:* Versions 12.4 build124053 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:* Versions 12.4 build124054 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:* Versions 12.4 build124056 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:* Versions 12.4 build124058 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:* Versions 12.4 build124065 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:* Versions 12.4 build124066 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:* Versions 12.4 build124067 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:* Versions 12.4 build124069 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:* Versions 12.4 build124070 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:* Versions 12.4 build124071 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:* Versions 12.4 build124074 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:* Versions 12.4 build124075 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:* Versions 12.4 build124081 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:* Versions 12.4 build124082 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:* Versions 12.4 build124085 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:* Versions 12.4 build124086 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:* Versions 12.4 build124087 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124089:*:*:*:*:*:* Versions 12.4 build124089 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124095:*:*:*:*:*:* Versions 12.4 build124095 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124096:*:*:*:*:*:* Versions 12.4 build124096 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124097:*:*:*:*:*:* Versions 12.4 build124097 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124098:*:*:*:*:*:* Versions 12.4 build124098 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124099:*:*:*:*:*:* Versions 12.4 build124099 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124100:*:*:*:*:*:* Versions 12.4 build124100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124101:*:*:*:*:*:* Versions 12.4 build124101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124102:*:*:*:*:*:* Versions 12.4 build124102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124168:*:*:*:*:*:* Versions 12.4 build124168 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124169:*:*:*:*:*:* Versions 12.4 build124169 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124175:*:*:*:*:*:* Versions 12.4 build124175 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124176:*:*:*:*:*:* Versions 12.4 build124176 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124178:*:*:*:*:*:* Versions 12.4 build124178 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11527
  2. 2026-10-03 Alias added: GHSA-x3qp-94wv-26rv

References

Advisory 1

  • TI-2022-11994 Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. CVSS 3.1CRITICAL 9.8
  • TI-2021-18117 Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. CVSS 3.1CRITICAL 9.8
  • TI-2020-17379 Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13137 An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. CVSS 3.1CRITICAL 9.8
  • TI-2023-14824 Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote… CVSS 3.1HIGH 8.8
  • TI-2018-12325 Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences