ZeroDay Findings
Sign inSign up

Findings

CVE-2022-28810

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

Published Apr 18, 2022 · updated Jun 16, 2026 · zohocorp manageengine adselfservice plus

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 18, 2022 · Catalog

    Detected

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbit

  2. Mar 7, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 28, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbit

Required action

Apply updates per vendor instructions.

CISA due date Mar 28, 2023

Affected

  • cpe zohocorp/manageengine adselfservice plusversion unspecified
  • cpe zohocorp/manageengine adselfservice plus6.1
  • vendor Zoho ManageEngineversion unspecified

Sources

  • CISA KEVCVE-2022-28810

    Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.

    cisa.gov
  • CVE.orgCVE-2022-28810

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-28810

    30-day exploitation probability 71.0%

    first.org
  • Metasploit Modulesexploit_windows/http/manageengine_adselfservice_plus_cve_2022_28810

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-28810

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this fu

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References