Read the docs
TI-2020-17379 Aliases CVE-2020-28653GHSA-hxf4-fh6h-hq94

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)…

Priority HIGH 82Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

Why it matters now

EPSS 0.77853 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*before 12.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:*12.5 build125000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:*12.5 build125002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:*12.5 build125100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:*12.5 build125101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:*12.5 build125102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:*12.5 build125108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:*12.5 build125110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:*12.5 build125111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:*12.5 build125112VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions before 12.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:* Versions 12.5 build125000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:* Versions 12.5 build125002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:* Versions 12.5 build125100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:* Versions 12.5 build125101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:* Versions 12.5 build125102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:* Versions 12.5 build125108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:* Versions 12.5 build125110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:* Versions 12.5 build125111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:* Versions 12.5 build125112 Vulnerable ·Zohocorp
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:*12.5 build125113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:*12.5 build125114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:*12.5 build125116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:*12.5 build125117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:*12.5 build125118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:*12.5 build125120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:*12.5 build125121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:*12.5 build125123VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:*12.5 build125124VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:*12.5 build125125VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:*12.5 build125136VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:*12.5 build125137VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:*12.5 build125139VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:*12.5 build125140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:*12.5 build125143VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125144:*:*:*:*:*:*12.5 build125144VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125145:*:*:*:*:*:*12.5 build125145VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125156:*:*:*:*:*:*12.5 build125156VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125157:*:*:*:*:*:*12.5 build125157VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125158:*:*:*:*:*:*12.5 build125158VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125159:*:*:*:*:*:*12.5 build125159VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125161:*:*:*:*:*:*12.5 build125161VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125163:*:*:*:*:*:*12.5 build125163VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125174:*:*:*:*:*:*12.5 build125174VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125175:*:*:*:*:*:*12.5 build125175VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125176:*:*:*:*:*:*12.5 build125176VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125177:*:*:*:*:*:*12.5 build125177VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125178:*:*:*:*:*:*12.5 build125178VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125180:*:*:*:*:*:*12.5 build125180VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125181:*:*:*:*:*:*12.5 build125181VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125192:*:*:*:*:*:*12.5 build125192VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125193:*:*:*:*:*:*12.5 build125193VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125194:*:*:*:*:*:*12.5 build125194VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125195:*:*:*:*:*:*12.5 build125195VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125196:*:*:*:*:*:*12.5 build125196VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125197:*:*:*:*:*:*12.5 build125197VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125198:*:*:*:*:*:*12.5 build125198VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125201:*:*:*:*:*:*12.5 build125201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125204:*:*:*:*:*:*12.5 build125204VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125212:*:*:*:*:*:*12.5 build125212VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125213:*:*:*:*:*:*12.5 build125213VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125214:*:*:*:*:*:*12.5 build125214VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125215:*:*:*:*:*:*12.5 build125215VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125216:*:*:*:*:*:*12.5 build125216VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125228:*:*:*:*:*:*12.5 build125228VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125229:*:*:*:*:*:*12.5 build125229VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125230:*:*:*:*:*:*12.5 build125230VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125231:*:*:*:*:*:*12.5 build125231VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125232:*:*:*:*:*:*12.5 build125232VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:* Versions 12.5 build125113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:* Versions 12.5 build125114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:* Versions 12.5 build125116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:* Versions 12.5 build125117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:* Versions 12.5 build125118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:* Versions 12.5 build125120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:* Versions 12.5 build125121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:* Versions 12.5 build125123 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:* Versions 12.5 build125124 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:* Versions 12.5 build125125 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:* Versions 12.5 build125136 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:* Versions 12.5 build125137 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:* Versions 12.5 build125139 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:* Versions 12.5 build125140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:* Versions 12.5 build125143 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125144:*:*:*:*:*:* Versions 12.5 build125144 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125145:*:*:*:*:*:* Versions 12.5 build125145 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125156:*:*:*:*:*:* Versions 12.5 build125156 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125157:*:*:*:*:*:* Versions 12.5 build125157 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125158:*:*:*:*:*:* Versions 12.5 build125158 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125159:*:*:*:*:*:* Versions 12.5 build125159 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125161:*:*:*:*:*:* Versions 12.5 build125161 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125163:*:*:*:*:*:* Versions 12.5 build125163 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125174:*:*:*:*:*:* Versions 12.5 build125174 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125175:*:*:*:*:*:* Versions 12.5 build125175 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125176:*:*:*:*:*:* Versions 12.5 build125176 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125177:*:*:*:*:*:* Versions 12.5 build125177 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125178:*:*:*:*:*:* Versions 12.5 build125178 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125180:*:*:*:*:*:* Versions 12.5 build125180 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125181:*:*:*:*:*:* Versions 12.5 build125181 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125192:*:*:*:*:*:* Versions 12.5 build125192 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125193:*:*:*:*:*:* Versions 12.5 build125193 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125194:*:*:*:*:*:* Versions 12.5 build125194 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125195:*:*:*:*:*:* Versions 12.5 build125195 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125196:*:*:*:*:*:* Versions 12.5 build125196 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125197:*:*:*:*:*:* Versions 12.5 build125197 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125198:*:*:*:*:*:* Versions 12.5 build125198 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125201:*:*:*:*:*:* Versions 12.5 build125201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125204:*:*:*:*:*:* Versions 12.5 build125204 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125212:*:*:*:*:*:* Versions 12.5 build125212 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125213:*:*:*:*:*:* Versions 12.5 build125213 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125214:*:*:*:*:*:* Versions 12.5 build125214 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125215:*:*:*:*:*:* Versions 12.5 build125215 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125216:*:*:*:*:*:* Versions 12.5 build125216 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125228:*:*:*:*:*:* Versions 12.5 build125228 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125229:*:*:*:*:*:* Versions 12.5 build125229 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125230:*:*:*:*:*:* Versions 12.5 build125230 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125231:*:*:*:*:*:* Versions 12.5 build125231 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125232:*:*:*:*:*:* Versions 12.5 build125232 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28653
  2. 2026-10-03 Alias added: GHSA-hxf4-fh6h-hq94

References

Exploit 1

Advisory 2

  • TI-2022-11994 Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. CVSS 3.1CRITICAL 9.8
  • TI-2021-18117 Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. CVSS 3.1CRITICAL 9.8
  • TI-2019-13137 An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. CVSS 3.1CRITICAL 9.8
  • TI-2023-14824 Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote… CVSS 3.1HIGH 8.8
  • TI-2018-12325 Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. CVSS 3.0CRITICAL 9.8
  • TI-2015-06446 PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote… CVSS 2.0HIGH 9.0
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences