Read the docs
TI-2025-09197 Aliases CVE-2025-10020GHSA-66pm-g8mp-38vm

Command injection in Zohocorp ManageEngine ADManager Plus

Priority MEDIUM 47CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04542 91st percentileScored 2026-11-07
Fix Fixed ManageEngine ADManager Plus (Zohocorp): 8024

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZohocorpManageEngine ADManager Plusbefore 80248024Patch availableCNA
  • ManageEngine ADManager Plus VendorZohocorp Affected before 8024 Fixed in 8024 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*before 8.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8001:*:*:*:*:*:*8.0 8001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8002:*:*:*:*:*:*8.0 8002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8010:*:*:*:*:*:*8.0 8010VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8011:*:*:*:*:*:*8.0 8011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8012:*:*:*:*:*:*8.0 8012VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8020:*:*:*:*:*:*8.0 8020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8021:*:*:*:*:*:*8.0 8021VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8022:*:*:*:*:*:*8.0 8022VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8023:*:*:*:*:*:*8.0 8023VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8001:*:*:*:*:*:* Versions 8.0 8001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8002:*:*:*:*:*:* Versions 8.0 8002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8010:*:*:*:*:*:* Versions 8.0 8010 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8011:*:*:*:*:*:* Versions 8.0 8011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8012:*:*:*:*:*:* Versions 8.0 8012 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8020:*:*:*:*:*:* Versions 8.0 8020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8021:*:*:*:*:*:* Versions 8.0 8021 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8022:*:*:*:*:*:* Versions 8.0 8022 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8023:*:*:*:*:*:* Versions 8.0 8023 Vulnerable ·Zohocorp

Remediation

  • Fix · CNA ManageEngine ADManager Plus (Zohocorp) Fixed in 8024

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10020
  2. 2026-10-03 Alias added: GHSA-66pm-g8mp-38vm

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15429 Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. CVSS 3.1CRITICAL 9.8
  • TI-2021-15685 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2021-15677 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload… CVSS 3.1CRITICAL 9.8
  • TI-2023-13526 Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit… CVSS 3.1HIGH 7.2
  • TI-2022-20900 Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute… CVSS 3.1HIGH 7.2
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences