Read the docs
TI-2022-11432 Aliases CVE-2022-28810GHSA-q392-qg7v-xvc4

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated…

Priority CRITICAL 89Exploited in the wildCWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-798 and CWE-78.

Summary

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

Why it matters now

Exploitation Active In CISA KEV since 2023-03-07CISA due date 2023-03-28
EPSS 0.70966 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*before 6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*6.1 6100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*6.1 6101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*6.1 6102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*6.1 6103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*6.1 6104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*6.1 6105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*6.1 6106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*6.1 6107VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* Versions 6.1 6100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* Versions 6.1 6101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* Versions 6.1 6102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* Versions 6.1 6103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* Versions 6.1 6104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* Versions 6.1 6105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* Versions 6.1 6106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:* Versions 6.1 6107 Vulnerable ·Zohocorp
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*6.1 6108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*6.1 6109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*6.1 6110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*6.1 6111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*6.1 6112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*6.1 6113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*6.1 6114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*6.1 6115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:*6.1 6116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:*6.1 6117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:*6.1 6118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:*6.1 6119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:*6.1 6120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6121:*:*:*:*:*:*6.1 6121VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:* Versions 6.1 6108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:* Versions 6.1 6109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:* Versions 6.1 6110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:* Versions 6.1 6111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:* Versions 6.1 6112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:* Versions 6.1 6113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:* Versions 6.1 6114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:* Versions 6.1 6115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:* Versions 6.1 6116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:* Versions 6.1 6117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:* Versions 6.1 6118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:* Versions 6.1 6119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:* Versions 6.1 6120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6121:*:*:*:*:*:* Versions 6.1 6121 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-03-07 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-28810
  3. 2026-10-03 Alias added: GHSA-q392-qg7v-xvc4

References

Exploit 3

Patch 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences