Read the docs
TI-2023-17876 Aliases CVE-2023-35786GHSA-22q6-rw64-5gjj

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.

Priority LOW 28CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03026 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*before 7.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:-:*:*:*:*:*:*7.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*7.1 7100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*7.1 7101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*7.1 7102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*7.1 7110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*7.1 7111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*7.1 7112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*7.1 7113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*7.1 7114VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:* Versions before 7.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:* Versions 7.1 7100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:* Versions 7.1 7101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:* Versions 7.1 7102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:* Versions 7.1 7110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:* Versions 7.1 7111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:* Versions 7.1 7112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:* Versions 7.1 7113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:* Versions 7.1 7114 Vulnerable ·Zohocorp
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*7.1 7115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*7.1 7116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:*7.1 7117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:*7.1 7118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:*7.1 7120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:*7.1 7121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:*7.1 7122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:*7.1 7123VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:*7.1 7124VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:*7.1 7125VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:*7.1 7126VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:*7.1 7130VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:*7.1 7131VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:*7.1 7140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:*7.1 7141VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:*7.1 7150VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:*7.1 7151VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:*7.1 7160VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:*7.1 7161VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7162:*:*:*:*:*:*7.1 7162VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7163:*:*:*:*:*:*7.1 7163VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7170:*:*:*:*:*:*7.1 7170VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7171:*:*:*:*:*:*7.1 7171VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7180:*:*:*:*:*:*7.1 7180VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7181:*:*:*:*:*:*7.1 7181VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7182:*:*:*:*:*:*7.1 7182VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:* Versions 7.1 7115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:* Versions 7.1 7116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:* Versions 7.1 7117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:* Versions 7.1 7118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:* Versions 7.1 7120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:* Versions 7.1 7121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:* Versions 7.1 7122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:* Versions 7.1 7123 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:* Versions 7.1 7124 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:* Versions 7.1 7125 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:* Versions 7.1 7126 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:* Versions 7.1 7130 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:* Versions 7.1 7131 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:* Versions 7.1 7140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:* Versions 7.1 7141 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:* Versions 7.1 7150 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:* Versions 7.1 7151 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:* Versions 7.1 7160 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:* Versions 7.1 7161 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7162:*:*:*:*:*:* Versions 7.1 7162 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7163:*:*:*:*:*:* Versions 7.1 7163 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7170:*:*:*:*:*:* Versions 7.1 7170 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7171:*:*:*:*:*:* Versions 7.1 7171 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7180:*:*:*:*:*:* Versions 7.1 7180 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7181:*:*:*:*:*:* Versions 7.1 7181 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7182:*:*:*:*:*:* Versions 7.1 7182 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35786
  2. 2026-10-03 Alias added: GHSA-22q6-rw64-5gjj

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15429 Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. CVSS 3.1CRITICAL 9.8
  • TI-2021-15685 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2021-15677 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2023-13526 Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit… CVSS 3.1HIGH 7.2
  • TI-2022-20900 Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute… CVSS 3.1HIGH 7.2
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences