Zoho

Vulnerability activity for Zoho: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

6.8MediumApr 18, 2022Zoho ManageEngine Code / command injectionCVE-2022-28810ManageEngine ADSelfService Plus, a self-service password management tool. An attacker gains Remote Code Execution, potentially allowing them to execute arbitrary code on the target system. Update to the latest version of ManageEngine ADSelfService Plus to patch the vulnerability.Added to KEV Mar 7, 2023 · 322 days after publicationExploited71% likelyExploit codeMetasploit
9.8CriticalJan 18, 2023Zoho ManageEngine Code / command injectionCVE-2022-47966ManageEngine products, Remote code execution on the target system, Update to the latest version of affected ManageEngine products.Added to KEV Jan 23, 2023 · 5 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalJul 19, 2022Zoho ManageEngine DeserializationCVE-2022-35405Affected: Zoho ManageEngine products including Desktop Central, ServiceDesk Plus, and other related products. Attacker gains: Remote code execution, potentially leading to full system compromise. Recommended action: Immediately update to the latest version of affected products and apply patches.Added to KEV Sep 22, 2022 · 64 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalDec 12, 2021Zoho Desktop Central Auth bypass / access controlCVE-2021-44515Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.Added to KEV Dec 10, 2021 · same day as publicationExploited100% likelyExploit codeNucleiDetection
9.8CriticalNov 29, 2021Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus Auth bypass / access controlCVE-2021-44077ServiceDesk Plus Unauthenticated remote code execution Update to version 11722 or later.Added to KEV Dec 1, 2021 · 2 days after publicationExploited93% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalSep 1, 2021Zoho ManageEngine ServiceDesk Plus (SDP) Auth bypass / access controlCVE-2021-37415(1) Zoho ManageEngine ServiceDesk is affected. (2) An attacker gains unauthorized access to the system. (3) Update to the latest version of ManageEngine ServiceDesk.Added to KEV Dec 1, 2021 · 91 days after publicationExploited100% likelyExploit codeNucleiDetection
7.5HighFeb 17, 2019Zoho ManageEngine Path traversal / file handlingCVE-2019-8394Affected: Zoho ManageEngine ServiceDesk Plus (SDP) versions 10.2 and prior. Attacker gains: Ability to upload arbitrary files to the server, potentially leading to remote code execution. Recommended action: Upgrade to ServiceDesk Plus version 10.2 or later, and apply security patches as recommended by Zoho ManageEngine.Added to KEV Nov 3, 2021 · 990 days after publicationExploited63% likelyExploit codeExploit-DB · Metasploit
9.8CriticalMar 6, 2020Zoho ManageEngine DeserializationCVE-2020-10189Affected: Zoho ManageEngine Desktop Central versions prior to 10.0 Patch 2. Attacker gains: Remote code execution (RCE) and arbitrary file upload capabilities. Recommended action: Upgrade to Zoho ManageEngine Desktop Central version 10.0 Patch 2 or later, or disable file upload functionality until the patch is applied.Added to KEV Nov 3, 2021 · 606 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
9.8CriticalSep 7, 2021Zoho ManageEngine Auth bypass / access controlCVE-2021-40539Affected: Zoho ManageEngine ADSelfService Plus, a self-service password management solution. Attacker gains: Unauthenticated access to the system, allowing for potential lateral movement and data exfiltration. Recommended action: Immediately update to the latest version of ADSelfService Plus, and apply any available patches or security updates.Added to KEV Nov 3, 2021 · 56 days after publicationExploited99% likelyExploit codeMetasploit · NucleiDetection

Recent

6.8MediumApr 18, 2022Zoho ManageEngine Code / command injectionCVE-2022-28810ManageEngine ADSelfService Plus, a self-service password management tool. An attacker gains Remote Code Execution, potentially allowing them to execute arbitrary code on the target system. Update to the latest version of ManageEngine ADSelfService Plus to patch the vulnerability.Exploited71% likelyExploit codeMetasploit
9.8CriticalJan 18, 2023Zoho ManageEngine Code / command injectionCVE-2022-47966ManageEngine products, Remote code execution on the target system, Update to the latest version of affected ManageEngine products.Exploited100% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalJul 19, 2022Zoho ManageEngine DeserializationCVE-2022-35405Affected: Zoho ManageEngine products including Desktop Central, ServiceDesk Plus, and other related products. Attacker gains: Remote code execution, potentially leading to full system compromise. Recommended action: Immediately update to the latest version of affected products and apply patches.Exploited100% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalDec 12, 2021Zoho Desktop Central Auth bypass / access controlCVE-2021-44515Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.Exploited100% likelyExploit codeNucleiDetection
9.8CriticalNov 29, 2021Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus Auth bypass / access controlCVE-2021-44077ServiceDesk Plus Unauthenticated remote code execution Update to version 11722 or later.Exploited93% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalSep 1, 2021Zoho ManageEngine ServiceDesk Plus (SDP) Auth bypass / access controlCVE-2021-37415(1) Zoho ManageEngine ServiceDesk is affected. (2) An attacker gains unauthorized access to the system. (3) Update to the latest version of ManageEngine ServiceDesk.Exploited100% likelyExploit codeNucleiDetection
9.8CriticalSep 7, 2021Zoho ManageEngine Auth bypass / access controlCVE-2021-40539Affected: Zoho ManageEngine ADSelfService Plus, a self-service password management solution. Attacker gains: Unauthenticated access to the system, allowing for potential lateral movement and data exfiltration. Recommended action: Immediately update to the latest version of ADSelfService Plus, and apply any available patches or security updates.Exploited99% likelyExploit codeMetasploit · NucleiDetection
9.8CriticalMar 6, 2020Zoho ManageEngine DeserializationCVE-2020-10189Affected: Zoho ManageEngine Desktop Central versions prior to 10.0 Patch 2. Attacker gains: Remote code execution (RCE) and arbitrary file upload capabilities. Recommended action: Upgrade to Zoho ManageEngine Desktop Central version 10.0 Patch 2 or later, or disable file upload functionality until the patch is applied.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.5HighFeb 17, 2019Zoho ManageEngine Path traversal / file handlingCVE-2019-8394Affected: Zoho ManageEngine ServiceDesk Plus (SDP) versions 10.2 and prior. Attacker gains: Ability to upload arbitrary files to the server, potentially leading to remote code execution. Recommended action: Upgrade to ServiceDesk Plus version 10.2 or later, and apply security patches as recommended by Zoho ManageEngine.Exploited63% likelyExploit codeExploit-DB · Metasploit

See every Zoho entry on the dashboard.

Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.