[ Vendor · 35 CVEs ]
Zohocorp
CVEs affecting Zohocorp published in the last 30 days, plus any Zohocorp CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-14308 | 13 Oct 2026 | CVSS 4.9 | Zohocorp ManageEngine Malware Protection PlusZohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService. | |
| CVE-2026-12265 | 28 Sep 2026 | CVSS 8.8 | Zohocorp DDI CentralZohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive… | |
| CVE-2026-12264 | 28 Sep 2026 | CVSS 8.8 | Zohocorp DDI CentralZohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote… | |
| CVE-2026-12268 | 28 Sep 2026 | CVSS 8.8 | Zohocorp DDI CentralManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code… | |
| CVE-2026-12269 | 28 Sep 2026 | CVSS 8.8 | Zohocorp DDI CentralZohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow… | |
| CVE-2026-12267 | 28 Sep 2026 | CVSS 7.2 | Zohocorp DDI CentralManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote… | |
| CVE-2026-92905 | 24 Sep 2026 | CVSS 5.3 | Zohocorp ManageEngine EventLog AnalyzerZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log… | |
| CVE-2026-86679 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged… | |
| CVE-2026-86681 | 23 Sep 2026 | CVSS 7.6 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged… | |
| CVE-2026-86683 | 23 Sep 2026 | CVSS 8.1 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings. | |
| CVE-2026-86708 | 23 Sep 2026 | CVSS 10.0 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the… | |
| CVE-2026-86677 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially… | |
| CVE-2026-86678 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to… | |
| CVE-2026-76978 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the… | |
| CVE-2026-76978 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the… | |
| CVE-2026-76979 | 23 Sep 2026 | CVSS 7.7 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule… | |
| CVE-2026-76979 | 23 Sep 2026 | CVSS 7.7 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule… | |
| CVE-2026-76980 | 23 Sep 2026 | CVSS 7.4 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall… | |
| CVE-2026-75825 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass… | |
| CVE-2026-19599 | 23 Sep 2026 | CVSS 9.9 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile… | |
| CVE-2026-84791 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that… | |
| CVE-2026-84787 | 23 Sep 2026 | CVSS 8.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that… | |
| CVE-2026-84789 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that… | |
| CVE-2026-12370 | 23 Sep 2026 | CVSS 7.6 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side… | |
| CVE-2026-14913 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule… | |
| CVE-2026-15358 | 23 Sep 2026 | CVSS 7.5 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal… | |
| CVE-2022-47966 | 18 Jan 2023 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionMultiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario… | ExploitedFix |
| CVE-2022-35405 | 19 Jul 2022 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionZoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also… | ExploitedFix |
| CVE-2022-28810 | 18 Apr 2022 | CVSS 6.8 | Zoho ManageEngine ADSelfService Plus Remote Code ExecutionZoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as… | ExploitedFix |
| CVE-2021-44515 | 12 Dec 2021 | CVSS 9.8 | Zoho Desktop Central Authentication BypassZoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in… | ExploitedFix |
| CVE-2021-44077 | 29 Nov 2021 | CVSS 9.8 | Zoho ManageEngine ServiceDesk Plus Remote Code ExecutionZoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to… | ExploitedFix |
| CVE-2021-40539 | 7 Sep 2021 | CVSS 9.8 | Zoho ManageEngine ADSelfService Plus Authentication BypassZoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ExploitedFix |
| CVE-2021-37415 | 1 Sep 2021 | CVSS 9.8 | Zoho ManageEngine ServiceDesk Authentication BypassZoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. | Exploited |
| CVE-2020-10189 | 6 Mar 2020 | CVSS 9.8 | Zoho ManageEngine Desktop Central File UploadZoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the… | Exploited |
| CVE-2019-8394 | 17 Feb 2019 | CVSS 6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) File UploadZoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | Exploited |