CVE-2022-47966

criticalKEV · exploitedEPSS 0.998 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · weaponized

Likely / severe?

99.8% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

59 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2023-01-23remediate by 2023-02-13

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-18

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (8)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966ManageEngine ADSelfService Plus Unauthenticated SAML RCEweaponized · metasploit
exploit/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966ManageEngine ServiceDesk Plus Unauthenticated SAML RCEweaponized · metasploit
exploit/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966ManageEngine Endpoint Central Unauthenticated SAML RCEweaponized · metasploit
ACE-Responder/CVE-2022-47966_checkerRun on your ManageEngine serverPoC · poc_in_github
horizon3ai/CVE-2022-47966POC for CVE-2022-47966 affecting multiple ManageEngine productsPoC · poc_in_github
sh4den/CVE-2022-47966The manage engine mass loader for CVE-2022-47966PoC · poc_in_github

affected products (59)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
ZOHO Corp. ADManager Plus≤ 7162fstec_bduRU
ZOHO Corp. Access Manager Plus≤ 4308fstec_bduRU
ZOHO Corp. Active Directory 360≤ 4310fstec_bduRU
ZOHO Corp. Analytics Plus≤ 5150fstec_bduRU
ZOHO Corp. Application Control Plus≤ 10.1.2220.18fstec_bduRU
ZOHO Corp. Asset Explorer≤ 6983fstec_bduRU
ZOHO Corp. Browser Security Plus≤ 11.1.2238.6fstec_bduRU
ZOHO Corp. Device Control Plus≤ 10.1.2220.18fstec_bduRU
ZOHO Corp. Endpoint Central≤ 10.1.2228.11fstec_bduRU
ZOHO Corp. Endpoint Central MSP≤ 10.1.2228.11fstec_bduRU
ZOHO Corp. Endpoint DLP≤ 10.1.2137.6fstec_bduRU
ZOHO Corp. Key Manager Plus≤ 6401fstec_bduRU
ZOHO Corp. ManageEngine ADSelfService Plus≤ 6211fstec_bduRU
ZOHO Corp. OS Deployer≤ 1.1.2243.1fstec_bduRU
ZOHO Corp. PAM360≤ 5713fstec_bduRU
ZOHO Corp. Password Manager Pro≤ 12124fstec_bduRU
ZOHO Corp. Patch Manager Plus≤ 10.1.2220.18fstec_bduRU
ZOHO Corp. Remote Access Plus≤ 10.1.2228.11fstec_bduRU
ZOHO Corp. Remote Monitoring and Management (RMM)≤ 10.1.41fstec_bduRU

showing 20 of 59

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0115Zoho ManageEngine Produkte: Schwachstelle ermöglicht Codeausführung mit SystemrechtenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter Angreifer kann eine Schwachstelle in mehreren Zoho ManageEngine Produkten ausnutzen, um beliebigen Programmcode mit Systemrechten auszuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2023-01-18modified 2026-08-03

references (36)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan