Read the docs
TI-2022-21264 Aliases CVE-2022-43473GHSA-mgjg-hm5j-p2wq

XML external entity injection in ManageEngine OpManager

Priority MEDIUM 59CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.19807 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ManageEngineOpManager 12.6.168—No fix listedCNA
  • OpManager VendorManageEngine Affected 12.6.168 Fixed in — No fix listed CNA

CPE configurations NVD · 81

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*before 12.6VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126000:*:*:*:*:*:*12.6 build126000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126001:*:*:*:*:*:*12.6 build126001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126002:*:*:*:*:*:*12.6 build126002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126004:*:*:*:*:*:*12.6 build126004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126005:*:*:*:*:*:*12.6 build126005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126100:*:*:*:*:*:*12.6 build126100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126101:*:*:*:*:*:*12.6 build126101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126102:*:*:*:*:*:*12.6 build126102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126103:*:*:*:*:*:*12.6 build126103VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions before 12.6 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126000:*:*:*:*:*:* Versions 12.6 build126000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126001:*:*:*:*:*:* Versions 12.6 build126001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126002:*:*:*:*:*:* Versions 12.6 build126002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126004:*:*:*:*:*:* Versions 12.6 build126004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126005:*:*:*:*:*:* Versions 12.6 build126005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126100:*:*:*:*:*:* Versions 12.6 build126100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126101:*:*:*:*:*:* Versions 12.6 build126101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126102:*:*:*:*:*:* Versions 12.6 build126102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126103:*:*:*:*:*:* Versions 12.6 build126103 Vulnerable ·Zohocorp
Show 71 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126104:*:*:*:*:*:*12.6 build126104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126107:*:*:*:*:*:*12.6 build126107VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126108:*:*:*:*:*:*12.6 build126108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126109:*:*:*:*:*:*12.6 build126109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126110:*:*:*:*:*:*12.6 build126110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126113:*:*:*:*:*:*12.6 build126113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126114:*:*:*:*:*:*12.6 build126114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126115:*:*:*:*:*:*12.6 build126115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126116:*:*:*:*:*:*12.6 build126116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126117:*:*:*:*:*:*12.6 build126117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126118:*:*:*:*:*:*12.6 build126118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126119:*:*:*:*:*:*12.6 build126119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126120:*:*:*:*:*:*12.6 build126120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126121:*:*:*:*:*:*12.6 build126121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126122:*:*:*:*:*:*12.6 build126122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126130:*:*:*:*:*:*12.6 build126130VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126131:*:*:*:*:*:*12.6 build126131VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126132:*:*:*:*:*:*12.6 build126132VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126134:*:*:*:*:*:*12.6 build126134VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126135:*:*:*:*:*:*12.6 build126135VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126136:*:*:*:*:*:*12.6 build126136VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126139:*:*:*:*:*:*12.6 build126139VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126141:*:*:*:*:*:*12.6 build126141VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126147:*:*:*:*:*:*12.6 build126147VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126148:*:*:*:*:*:*12.6 build126148VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126149:*:*:*:*:*:*12.6 build126149VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126150:*:*:*:*:*:*12.6 build126150VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126151:*:*:*:*:*:*12.6 build126151VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126154:*:*:*:*:*:*12.6 build126154VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126155:*:*:*:*:*:*12.6 build126155VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126162:*:*:*:*:*:*12.6 build126162VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126163:*:*:*:*:*:*12.6 build126163VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126164:*:*:*:*:*:*12.6 build126164VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126165:*:*:*:*:*:*12.6 build126165VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126166:*:*:*:*:*:*12.6 build126166VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126167:*:*:*:*:*:*12.6 build126167VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126168:*:*:*:*:*:*12.6 build126168VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:*:*:*:*:*:*:*:*before 12.6VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126001:*:*:*:*:*:*12.6 build126001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126002:*:*:*:*:*:*12.6 build126002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126100:*:*:*:*:*:*12.6 build126100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126103:*:*:*:*:*:*12.6 build126103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126104:*:*:*:*:*:*12.6 build126104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126107:*:*:*:*:*:*12.6 build126107VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126113:*:*:*:*:*:*12.6 build126113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126117:*:*:*:*:*:*12.6 build126117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126119:*:*:*:*:*:*12.6 build126119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126122:*:*:*:*:*:*12.6 build126122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126139:*:*:*:*:*:*12.6 build126139VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126140:*:*:*:*:*:*12.6 build126140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126141:*:*:*:*:*:*12.6 build126141VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126154:*:*:*:*:*:*12.6 build126154VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126155:*:*:*:*:*:*12.6 build126155VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126264:*:*:*:*:*:*12.6 build126264VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:*:*:*:*:*:*:*:*before 12.6VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126001:*:*:*:*:*:*12.6 build126001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126002:*:*:*:*:*:*12.6 build126002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126100:*:*:*:*:*:*12.6 build126100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126103:*:*:*:*:*:*12.6 build126103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126104:*:*:*:*:*:*12.6 build126104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126107:*:*:*:*:*:*12.6 build126107VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126113:*:*:*:*:*:*12.6 build126113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126117:*:*:*:*:*:*12.6 build126117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126119:*:*:*:*:*:*12.6 build126119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126122:*:*:*:*:*:*12.6 build126122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126139:*:*:*:*:*:*12.6 build126139VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126140:*:*:*:*:*:*12.6 build126140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126141:*:*:*:*:*:*12.6 build126141VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126154:*:*:*:*:*:*12.6 build126154VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126155:*:*:*:*:*:*12.6 build126155VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126264:*:*:*:*:*:*12.6 build126264VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126104:*:*:*:*:*:* Versions 12.6 build126104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126107:*:*:*:*:*:* Versions 12.6 build126107 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126108:*:*:*:*:*:* Versions 12.6 build126108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126109:*:*:*:*:*:* Versions 12.6 build126109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126110:*:*:*:*:*:* Versions 12.6 build126110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126113:*:*:*:*:*:* Versions 12.6 build126113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126114:*:*:*:*:*:* Versions 12.6 build126114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126115:*:*:*:*:*:* Versions 12.6 build126115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126116:*:*:*:*:*:* Versions 12.6 build126116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126117:*:*:*:*:*:* Versions 12.6 build126117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126118:*:*:*:*:*:* Versions 12.6 build126118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126119:*:*:*:*:*:* Versions 12.6 build126119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126120:*:*:*:*:*:* Versions 12.6 build126120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126121:*:*:*:*:*:* Versions 12.6 build126121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126122:*:*:*:*:*:* Versions 12.6 build126122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126130:*:*:*:*:*:* Versions 12.6 build126130 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126131:*:*:*:*:*:* Versions 12.6 build126131 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126132:*:*:*:*:*:* Versions 12.6 build126132 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126134:*:*:*:*:*:* Versions 12.6 build126134 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126135:*:*:*:*:*:* Versions 12.6 build126135 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126136:*:*:*:*:*:* Versions 12.6 build126136 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126139:*:*:*:*:*:* Versions 12.6 build126139 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126141:*:*:*:*:*:* Versions 12.6 build126141 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126147:*:*:*:*:*:* Versions 12.6 build126147 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126148:*:*:*:*:*:* Versions 12.6 build126148 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126149:*:*:*:*:*:* Versions 12.6 build126149 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126150:*:*:*:*:*:* Versions 12.6 build126150 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126151:*:*:*:*:*:* Versions 12.6 build126151 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126154:*:*:*:*:*:* Versions 12.6 build126154 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126155:*:*:*:*:*:* Versions 12.6 build126155 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126162:*:*:*:*:*:* Versions 12.6 build126162 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126163:*:*:*:*:*:* Versions 12.6 build126163 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126164:*:*:*:*:*:* Versions 12.6 build126164 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126165:*:*:*:*:*:* Versions 12.6 build126165 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126166:*:*:*:*:*:* Versions 12.6 build126166 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126167:*:*:*:*:*:* Versions 12.6 build126167 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126168:*:*:*:*:*:* Versions 12.6 build126168 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:*:*:*:*:*:*:*:* Versions before 12.6 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126001:*:*:*:*:*:* Versions 12.6 build126001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126002:*:*:*:*:*:* Versions 12.6 build126002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126100:*:*:*:*:*:* Versions 12.6 build126100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126103:*:*:*:*:*:* Versions 12.6 build126103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126104:*:*:*:*:*:* Versions 12.6 build126104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126107:*:*:*:*:*:* Versions 12.6 build126107 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126113:*:*:*:*:*:* Versions 12.6 build126113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126117:*:*:*:*:*:* Versions 12.6 build126117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126119:*:*:*:*:*:* Versions 12.6 build126119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126122:*:*:*:*:*:* Versions 12.6 build126122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126139:*:*:*:*:*:* Versions 12.6 build126139 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126140:*:*:*:*:*:* Versions 12.6 build126140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126141:*:*:*:*:*:* Versions 12.6 build126141 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126154:*:*:*:*:*:* Versions 12.6 build126154 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126155:*:*:*:*:*:* Versions 12.6 build126155 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126264:*:*:*:*:*:* Versions 12.6 build126264 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:*:*:*:*:*:*:*:* Versions before 12.6 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126001:*:*:*:*:*:* Versions 12.6 build126001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126002:*:*:*:*:*:* Versions 12.6 build126002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126100:*:*:*:*:*:* Versions 12.6 build126100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126103:*:*:*:*:*:* Versions 12.6 build126103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126104:*:*:*:*:*:* Versions 12.6 build126104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126107:*:*:*:*:*:* Versions 12.6 build126107 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126113:*:*:*:*:*:* Versions 12.6 build126113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126117:*:*:*:*:*:* Versions 12.6 build126117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126119:*:*:*:*:*:* Versions 12.6 build126119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126122:*:*:*:*:*:* Versions 12.6 build126122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126139:*:*:*:*:*:* Versions 12.6 build126139 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126140:*:*:*:*:*:* Versions 12.6 build126140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126141:*:*:*:*:*:* Versions 12.6 build126141 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126154:*:*:*:*:*:* Versions 12.6 build126154 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126155:*:*:*:*:*:* Versions 12.6 build126155 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126264:*:*:*:*:*:* Versions 12.6 build126264 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43473
  2. 2026-10-03 Alias added: GHSA-mgjg-hm5j-p2wq

References

Exploit 1

Patch 1

  • TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
  • TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
  • TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
  • TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
  • TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences