Read the docs
TI-2023-13526 Aliases CVE-2023-29084GHSA-q6fm-vxc6-q2wj

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit…

Priority HIGH 78CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.9801 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*before 7.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*7.1 7100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*7.1 7101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*7.1 7102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*7.1 7110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*7.1 7111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*7.1 7112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*7.1 7113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*7.1 7114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*7.1 7115VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:* Versions before 7.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:* Versions 7.1 7100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:* Versions 7.1 7101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:* Versions 7.1 7102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:* Versions 7.1 7110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:* Versions 7.1 7111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:* Versions 7.1 7112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:* Versions 7.1 7113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:* Versions 7.1 7114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:* Versions 7.1 7115 Vulnerable ·Zohocorp
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*7.1 7116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:*7.1 7117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:*7.1 7118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:*7.1 7120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:*7.1 7121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:*7.1 7122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:*7.1 7123VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:*7.1 7124VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:*7.1 7125VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:*7.1 7126VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:*7.1 7130VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:*7.1 7131VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:*7.1 7140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:*7.1 7141VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:*7.1 7150VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:*7.1 7151VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:*7.1 7160VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:*7.1 7161VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7162:*:*:*:*:*:*7.1 7162VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7163:*:*:*:*:*:*7.1 7163VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7170:*:*:*:*:*:*7.1 7170VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7171:*:*:*:*:*:*7.1 7171VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7180:*:*:*:*:*:*7.1 7180VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:* Versions 7.1 7116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:* Versions 7.1 7117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:* Versions 7.1 7118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:* Versions 7.1 7120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:* Versions 7.1 7121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:* Versions 7.1 7122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:* Versions 7.1 7123 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:* Versions 7.1 7124 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:* Versions 7.1 7125 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:* Versions 7.1 7126 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:* Versions 7.1 7130 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:* Versions 7.1 7131 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:* Versions 7.1 7140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:* Versions 7.1 7141 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:* Versions 7.1 7150 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:* Versions 7.1 7151 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:* Versions 7.1 7160 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:* Versions 7.1 7161 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7162:*:*:*:*:*:* Versions 7.1 7162 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7163:*:*:*:*:*:* Versions 7.1 7163 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7170:*:*:*:*:*:* Versions 7.1 7170 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7171:*:*:*:*:*:* Versions 7.1 7171 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7180:*:*:*:*:*:* Versions 7.1 7180 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29084
  2. 2026-10-03 Alias added: GHSA-q6fm-vxc6-q2wj

References

Advisory 1

Other 2

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15429 Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. CVSS 3.1CRITICAL 9.8
  • TI-2021-15685 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2021-15677 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2022-20900 Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute… CVSS 3.1HIGH 7.2
  • TI-2021-03430 Unrestricted file upload in ManageEngine ADManager Plus Build 7111 CVSS 3.1HIGH 8.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences