Read the docs
TI-2023-26494 Aliases CVE-2023-48646GHSA-grg4-qr9m-4rf3

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

Priority HIGH 72Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

Why it matters now

EPSS 0.82163 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:*:*:*:*:*:*:*:*before 6.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6001:*:*:*:*:*:*6.0 build6001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6003:*:*:*:*:*:*6.0 build6003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6005:*:*:*:*:*:*6.0 build6005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6011:*:*:*:*:*:*6.0 build6011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6016:*:*:*:*:*:*6.0 build6016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6017:*:*:*:*:*:*6.0 build6017VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6020:*:*:*:*:*:*6.0 build6020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6025:*:*:*:*:*:*6.0 build6025VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6026:*:*:*:*:*:*6.0 build6026VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:*:*:*:*:*:*:*:* Versions before 6.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6001:*:*:*:*:*:* Versions 6.0 build6001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6003:*:*:*:*:*:* Versions 6.0 build6003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6005:*:*:*:*:*:* Versions 6.0 build6005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6011:*:*:*:*:*:* Versions 6.0 build6011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6016:*:*:*:*:*:* Versions 6.0 build6016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6017:*:*:*:*:*:* Versions 6.0 build6017 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6020:*:*:*:*:*:* Versions 6.0 build6020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6025:*:*:*:*:*:* Versions 6.0 build6025 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6026:*:*:*:*:*:* Versions 6.0 build6026 Vulnerable ·Zohocorp
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6030:*:*:*:*:*:*6.0 build6030VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6031:*:*:*:*:*:*6.0 build6031VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6032:*:*:*:*:*:*6.0 build6032VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6041:*:*:*:*:*:*6.0 build6041VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6042:*:*:*:*:*:*6.0 build6042VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6043:*:*:*:*:*:*6.0 build6043VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6044:*:*:*:*:*:*6.0 build6044VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6047:*:*:*:*:*:*6.0 build6047VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6049:*:*:*:*:*:*6.0 build6049VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6050:*:*:*:*:*:*6.0 build6050VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6051:*:*:*:*:*:*6.0 build6051VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6053:*:*:*:*:*:*6.0 build6053VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6054:*:*:*:*:*:*6.0 build6054VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6056:*:*:*:*:*:*6.0 build6056VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6057:*:*:*:*:*:*6.0 build6057VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6058:*:*:*:*:*:*6.0 build6058VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6060:*:*:*:*:*:*6.0 build6060VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6061:*:*:*:*:*:*6.0 build6061VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6062:*:*:*:*:*:*6.0 build6062VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6030:*:*:*:*:*:* Versions 6.0 build6030 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6031:*:*:*:*:*:* Versions 6.0 build6031 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6032:*:*:*:*:*:* Versions 6.0 build6032 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6041:*:*:*:*:*:* Versions 6.0 build6041 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6042:*:*:*:*:*:* Versions 6.0 build6042 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6043:*:*:*:*:*:* Versions 6.0 build6043 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6044:*:*:*:*:*:* Versions 6.0 build6044 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6047:*:*:*:*:*:* Versions 6.0 build6047 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6049:*:*:*:*:*:* Versions 6.0 build6049 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6050:*:*:*:*:*:* Versions 6.0 build6050 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6051:*:*:*:*:*:* Versions 6.0 build6051 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6053:*:*:*:*:*:* Versions 6.0 build6053 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6054:*:*:*:*:*:* Versions 6.0 build6054 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6056:*:*:*:*:*:* Versions 6.0 build6056 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6057:*:*:*:*:*:* Versions 6.0 build6057 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6058:*:*:*:*:*:* Versions 6.0 build6058 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6060:*:*:*:*:*:* Versions 6.0 build6060 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6061:*:*:*:*:*:* Versions 6.0 build6061 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_recoverymanager_plus:6.0:build6062:*:*:*:*:*:* Versions 6.0 build6062 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48646
  2. 2026-10-03 Alias added: GHSA-grg4-qr9m-4rf3

References

Advisory 1

  • TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences