Read the docs
TI-2025-08976 Aliases CVE-2025-9787GHSA-4wcm-79rp-rw98

Stored XSS in Zohocorp ManageEngine Applications Manager

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01104 65th percentileScored 2026-11-07
Fix Fixed ManageEngine Applications Manager (Zohocorp): 177500

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZohocorpManageEngine Applications Managerbefore 177500177500Patch availableCNA
  • ManageEngine Applications Manager VendorZohocorp Affected before 177500 Fixed in 177500 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*17.4 to before 17.7VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173300:*:*:*:*:*:*17.3 build173300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173301:*:*:*:*:*:*17.3 build173301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173302:*:*:*:*:*:*17.3 build173302VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173303:*:*:*:*:*:*17.3 build173303VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173304:*:*:*:*:*:*17.3 build173304VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:-:*:*:*:*:*:*17.7VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177000:*:*:*:*:*:*17.7 build177000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177100:*:*:*:*:*:*17.7 build177100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177200:*:*:*:*:*:*17.7 build177200VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* Versions 17.4 to before 17.7 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173300:*:*:*:*:*:* Versions 17.3 build173300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173301:*:*:*:*:*:* Versions 17.3 build173301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173302:*:*:*:*:*:* Versions 17.3 build173302 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173303:*:*:*:*:*:* Versions 17.3 build173303 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.3:build173304:*:*:*:*:*:* Versions 17.3 build173304 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:-:*:*:*:*:*:* Versions 17.7 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177000:*:*:*:*:*:* Versions 17.7 build177000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177100:*:*:*:*:*:* Versions 17.7 build177100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177200:*:*:*:*:*:* Versions 17.7 build177200 Vulnerable ·Zohocorp
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177201:*:*:*:*:*:*17.7 build177201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177202:*:*:*:*:*:*17.7 build177202VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177203:*:*:*:*:*:*17.7 build177203VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177204:*:*:*:*:*:*17.7 build177204VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177300:*:*:*:*:*:*17.7 build177300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177400:*:*:*:*:*:*17.7 build177400VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177201:*:*:*:*:*:* Versions 17.7 build177201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177202:*:*:*:*:*:* Versions 17.7 build177202 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177203:*:*:*:*:*:* Versions 17.7 build177203 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177204:*:*:*:*:*:* Versions 17.7 build177204 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177300:*:*:*:*:*:* Versions 17.7 build177300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:17.7:build177400:*:*:*:*:*:* Versions 17.7 build177400 Vulnerable ·Zohocorp

Remediation

  • Fix · CNA ManageEngine Applications Manager (Zohocorp) Fixed in 177500

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9787
  2. 2026-10-03 Alias added: GHSA-4wcm-79rp-rw98

References

Patch 1

  • TI-2018-05713 A remote code execution issue was discovered in Zoho ManageEngine Applications Manager… CVSS 3.0CRITICAL 9.8
  • TI-2014-06533 The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications… CVSS 3.1HIGH 7.5
  • TI-2023-12889 Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager… CVSS 3.1MEDIUM 6.1
  • TI-2018-09364 A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x… CVSS 3.0CRITICAL 9.8
  • TI-2020-12793 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
  • TI-2020-12540 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences