Zohocorp
Vulnerability activity for Zohocorp: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 12
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 42
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 60
- Critical (CVSS 9+)
- 5
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.7HighNov 4, 2026Zohocorp ManageEngine Key Manager Plus Auth bypass / access controlCVE-2026-77779ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
- 8.8HighNov 4, 2026Zohocorp ManageEngine Key Manager Plus Code / command injectionCVE-2026-77690ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
- 7.1HighNov 3, 2026Zohocorp ManageEngine Key Manager PlusCVE-2026-77778ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
- 7.1HighNov 3, 2026Zohocorp ManageEngine Key Manager Plus Auth bypass / access controlCVE-2026-77777ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
- 8.1HighNov 3, 2026Zohocorp ManageEngine Key Manager Plus Code / command injectionCVE-2026-77691ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA1.4% likely
- 7.5HighNov 3, 2026Zohocorp Log360 Auth bypass / access controlCVE-2026-16900Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.1.5% likely
- 9.1CriticalNov 3, 2026Zohocorp Log360 Auth bypass / access controlCVE-2026-13594Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.1.1% likely
- 7.7HighNov 3, 2026Zohocorp ManageEngine Key Manager Plus Auth bypass / access controlCVE-2026-77800ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.
- 7.4HighNov 3, 2026Zohocorp ManageEngine Key Manager Plus Auth bypass / access controlCVE-2026-77799ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.1.2% likely
- 8.7HighNov 2, 2026Zohocorp ManageEngine Eventlog Analyzer Code / command injectionCVE-2026-8923Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.2.2% likely
- 8.8HighNov 2, 2026Zohocorp ManageEngine Password Manager Pro Code / command injectionCVE-2026-18199Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.2.5% likely
- 4.9MediumOct 13, 2026Zohocorp ManageEngine Malware Protection PlusCVE-2026-14308Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.
- 8.8HighSep 28, 2026Zohocorp DDI Central Auth bypass / access controlCVE-2026-12265Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
- 8.8HighSep 28, 2026Zohocorp DDI Central Path traversal / file handlingCVE-2026-12264Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.
- 8.8HighSep 28, 2026Zohocorp DDI Central Privilege escalationCVE-2026-12269Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
- 8.8HighSep 28, 2026Zohocorp DDI Central Code / command injectionCVE-2026-12268ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
- 7.2HighSep 28, 2026Zohocorp DDI Central Code / command injectionCVE-2026-12267ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
- 10.0CriticalSep 23, 2026Zohocorp ManageEngine Applications Manager Crypto / certificateCVE-2026-86708ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
- 8.1HighSep 23, 2026Zohocorp ManageEngine Applications ManagerCVE-2026-86683ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
- 7.6HighSep 23, 2026Zohocorp ManageEngine Applications Manager Auth bypass / access controlCVE-2026-86681ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
- 7.1HighSep 23, 2026Zohocorp ManageEngine Applications ManagerCVE-2026-86679ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
- 8.8HighSep 23, 2026Zohocorp ManageEngine Applications Manager Auth bypass / access controlCVE-2026-86678ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- 8.8HighSep 23, 2026Zohocorp ManageEngine Applications Manager SQL injectionCVE-2026-86677ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
- 7.4HighSep 23, 2026Zohocorp ManageEngine OpManagerCVE-2026-76980ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
- 7.7HighSep 23, 2026Zohocorp ManageEngine OpManagerCVE-2026-76979ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- 8.8HighSep 23, 2026Zohocorp ManageEngine OpManager Code / command injectionCVE-2026-76978ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- 8.8HighSep 23, 2026Zohocorp ManageEngine OpManager Auth bypass / access controlCVE-2026-75825ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
- 9.9CriticalSep 23, 2026Zohocorp ManageEngine OpManager Code / command injectionCVE-2026-19599ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- 7.1HighSep 23, 2026Zohocorp ManageEngine OpManager Auth bypass / access controlCVE-2026-84791ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
- 7.1HighSep 23, 2026Zohocorp ManageEngine OpManager Auth bypass / access controlCVE-2026-84789ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.
- 8.1HighSep 23, 2026Zohocorp ManageEngine OpManager Privilege escalationCVE-2026-84787ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- 7.5HighSep 23, 2026Zohocorp ManageEngine OpManager Privilege escalationCVE-2026-15358ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
- 8.8HighSep 23, 2026Zohocorp ManageEngine OpManager SQL injectionCVE-2026-14913ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- 7.6HighSep 23, 2026Zohocorp ManageEngine OpManager Code / command injectionCVE-2026-12370ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
- 8.6HighSep 22, 2026Zohocorp ManageEngine ADSelfService Plus Auth bypass / access controlCVE-2026-75791Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
- 9.8CriticalSep 22, 2026Zohocorp ManageEngine ADSelfService Plus Code / command injectionCVE-2026-74849Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
- 7.7HighSep 18, 2026Zohocorp ManageEngine DataSecurity Plus SQL injectionCVE-2026-18912ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.
- 7.5HighSep 18, 2026Zohocorp ManageEngine DataSecurity Plus Auth bypass / access controlCVE-2026-18911ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
- 6.3MediumSep 7, 2026Zohocorp ManageEngine Endpoint Central Privilege escalationCVE-2026-85640Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component
- 5.0MediumSep 7, 2026Zohocorp ManageEngine Endpoint Central Privilege escalationCVE-2026-77699Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.
- 6.3MediumSep 7, 2026Zohocorp ManageEngine Endpoint Central Privilege escalationCVE-2026-77697Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
- 5.7MediumSep 7, 2026Zohocorp ManageEngine Endpoint Central Privilege escalationCVE-2026-77698Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.
- 8.2HighApr 16, 2026Zohocorp manageengine log360 Auth bypass / access controlCVE-2026-3324Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-27655Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-4108Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-3880Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-3879Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-28703Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
- 7.3HighApr 3, 2026Zohocorp manageengine exchange reporter plus XSSCVE-2026-28756Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
Top products
- manageengine exchange reporter plus12 CVEs in the last year
- ManageEngine OpManager11 CVEs in the last year, 1 critical
- ManageEngine Key Manager Plus7 CVEs in the last year
- ManageEngine Applications Manager7 CVEs in the last year, 1 critical
- DDI Central5 CVEs in the last year
- ManageEngine Endpoint Central4 CVEs in the last year
- ManageEngine ADSelfService Plus3 CVEs in the last year, 2 critical
- ManageEngine DataSecurity Plus2 CVEs in the last year
- manageengine admanager plus2 CVEs in the last year
- Log3602 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.