Read the docs
TI-2023-11733 Aliases CVE-2023-26601GHSA-ww5h-4h29-gwjp

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987…

Priority MEDIUM 64CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.34065 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:*before 6.9VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:-:*:*:*:*:*:*6.9VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:*6.9 6900VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:*6.9 6901VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:*6.9 6902VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:*6.9 6903VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:*6.9 6904VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:*6.9 6905VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:*6.9 6906VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:*6.9 6907VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:* Versions before 6.9 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:-:*:*:*:*:*:* Versions 6.9 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:* Versions 6.9 6900 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:* Versions 6.9 6901 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:* Versions 6.9 6902 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:* Versions 6.9 6903 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:* Versions 6.9 6904 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:* Versions 6.9 6905 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:* Versions 6.9 6906 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:* Versions 6.9 6907 Vulnerable ·Zohocorp
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:*6.9 6908VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:*6.9 6909VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:*6.9 6950VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:*6.9 6951VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:*6.9 6952VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:*6.9 6953VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:*6.9 6954VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:*6.9 6955VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:*6.9 6956VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:*6.9 6957VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:*6.9 6970VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:*6.9 6971VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:*6.9 6972VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:*6.9 6973VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:*6.9 6974VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:*6.9 6975VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:*6.9 6976VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:*6.9 6977VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:*6.9 6978VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:*6.9 6979VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:*6.9 6980VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:*6.9 6981VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:*6.9 6982VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6983:*:*:*:*:*:*6.9 6983VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6984:*:*:*:*:*:*6.9 6984VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6985:*:*:*:*:*:*6.9 6985VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6986:*:*:*:*:*:*6.9 6986VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6987:*:*:*:*:*:*6.9 6987VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*before 14.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:-:*:*:*:*:*:*14.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14100:*:*:*:*:*:*14.1 14100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14101:*:*:*:*:*:*14.1 14101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14102:*:*:*:*:*:*14.1 14102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14103:*:*:*:*:*:*14.1 14103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*before 14.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.0:14000:*:*:*:*:*:*14.0 14000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*before 14.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.0:14000:*:*:*:*:*:*14.0 14000VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:* Versions 6.9 6908 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:* Versions 6.9 6909 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:* Versions 6.9 6950 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:* Versions 6.9 6951 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:* Versions 6.9 6952 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:* Versions 6.9 6953 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:* Versions 6.9 6954 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:* Versions 6.9 6955 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:* Versions 6.9 6956 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:* Versions 6.9 6957 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:* Versions 6.9 6970 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:* Versions 6.9 6971 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:* Versions 6.9 6972 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:* Versions 6.9 6973 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:* Versions 6.9 6974 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:* Versions 6.9 6975 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:* Versions 6.9 6976 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:* Versions 6.9 6977 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:* Versions 6.9 6978 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:* Versions 6.9 6979 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:* Versions 6.9 6980 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:* Versions 6.9 6981 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:* Versions 6.9 6982 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6983:*:*:*:*:*:* Versions 6.9 6983 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6984:*:*:*:*:*:* Versions 6.9 6984 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6985:*:*:*:*:*:* Versions 6.9 6985 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6986:*:*:*:*:*:* Versions 6.9 6986 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6987:*:*:*:*:*:* Versions 6.9 6987 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions before 14.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:-:*:*:*:*:*:* Versions 14.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14100:*:*:*:*:*:* Versions 14.1 14100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14101:*:*:*:*:*:* Versions 14.1 14101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14102:*:*:*:*:*:* Versions 14.1 14102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.1:14103:*:*:*:*:*:* Versions 14.1 14103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.0:14000:*:*:*:*:*:* Versions 14.0 14000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.0:14000:*:*:*:*:*:* Versions 14.0 14000 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26601
  2. 2026-10-03 Alias added: GHSA-ww5h-4h29-gwjp

References

Advisory 1

Other 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-03410 Integer overflow in Manage Engine Asset Explorer Agent CVSS 3.1CRITICAL 9.8
  • TI-2019-09733 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version… CVSS 3.0CRITICAL 9.1
  • TI-2019-10915 Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection… CVSS 3.0HIGH 8.5
  • TI-2019-09702 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and… CVSS 3.0HIGH 8.8
  • TI-2022-15979 Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and… CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences