ZeroDay Findings
Sign inSign up

Findings

CVE-2022-47966

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Published Jan 18, 2023 · updated Jul 30, 2026 · zohocorp manageengine access manager plus

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Timeline

Detection, updates, and resolution for this record.

  1. Jan 18, 2023 · Catalog

    Detected

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects A

  2. Jan 23, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Feb 13, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jul 30, 2026 · Catalog

    Updated

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects A

Required action

Apply updates per vendor instructions.

CISA due date Feb 13, 2023

Affected

  • cpe zohocorp/manageengine access manager plusversion unspecified
  • cpe zohocorp/manageengine access manager plus4.3
  • cpe zohocorp/manageengine ad360version unspecified
  • cpe zohocorp/manageengine adaudit plusversion unspecified
  • cpe zohocorp/manageengine admanager plusversion unspecified
  • cpe zohocorp/manageengine adselfservice plusversion unspecified
  • vendor Zoho ManageEngineversion unspecified

Sources

  • AttackerKBhttps://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

    AttackerKB link already published on the finding.

    attackerkb.com
  • CISA KEVCVE-2022-47966

    Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

    cisa.gov
  • CVE.orgCVE-2022-47966

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-47966

    30-day exploitation probability 99.8%

    first.org
  • Metasploit Modulesexploit_multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-47966

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityp://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securitytp://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References