CVE-2022-36923: High severity manageengine firewall analyzer vulnerability

Published Aug 10, 2022
·
Updated

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Affected Software

108 affected components
ZohoCorp Manageengine Firewall Analyzer=12.5-build125450
ZohoCorp Manageengine Firewall Analyzer=12.5-build125451
ZohoCorp Manageengine Firewall Analyzer=12.5-build125452
ZohoCorp Manageengine Firewall Analyzer=12.5-build125453
ZohoCorp Manageengine Firewall Analyzer=12.5-build125455
ZohoCorp Manageengine Firewall Analyzer=12.5-build125456
ZohoCorp Manageengine Firewall Analyzer=12.5-build125664
ZohoCorp Manageengine Firewall Analyzer=12.6-build126000
ZohoCorp Manageengine Firewall Analyzer=12.6-build126001
ZohoCorp Manageengine Firewall Analyzer=12.6-build126100
ZohoCorp Manageengine Firewall Analyzer=12.6-build126101
ZohoCorp Manageengine Firewall Analyzer=12.6-build126102
ZohoCorp Manageengine Firewall Analyzer=12.6-build126103
ZohoCorp Manageengine Firewall Analyzer=12.6-build126113
ZohoCorp Manageengine Firewall Analyzer=12.6-build126114
ZohoCorp Manageengine Firewall Analyzer=12.6-build126115
ZohoCorp Manageengine Firewall Analyzer=12.6-build126116
ZohoCorp Manageengine Firewall Analyzer=12.6-build126117
ZohoCorp Manageengine Netflow Analyzer=12.5-build125450
ZohoCorp Manageengine Netflow Analyzer=12.5-build125451
ZohoCorp Manageengine Netflow Analyzer=12.5-build125452
ZohoCorp Manageengine Netflow Analyzer=12.5-build125453
ZohoCorp Manageengine Netflow Analyzer=12.5-build125455
ZohoCorp Manageengine Netflow Analyzer=12.5-build125456
ZohoCorp Manageengine Netflow Analyzer=12.5-build125664
ZohoCorp Manageengine Netflow Analyzer=12.6-build126000
ZohoCorp Manageengine Netflow Analyzer=12.6-build126001
ZohoCorp Manageengine Netflow Analyzer=12.6-build126100
ZohoCorp Manageengine Netflow Analyzer=12.6-build126101
ZohoCorp Manageengine Netflow Analyzer=12.6-build126102
ZohoCorp Manageengine Netflow Analyzer=12.6-build126103
ZohoCorp Manageengine Netflow Analyzer=12.6-build126113
ZohoCorp Manageengine Netflow Analyzer=12.6-build126114
ZohoCorp Manageengine Netflow Analyzer=12.6-build126115
ZohoCorp Manageengine Netflow Analyzer=12.6-build126116
ZohoCorp Manageengine Netflow Analyzer=12.6-build126117
Zohocorp Manageengine Network Configuration Manager=12.5-build125450
Zohocorp Manageengine Network Configuration Manager=12.5-build125451
Zohocorp Manageengine Network Configuration Manager=12.5-build125452
Zohocorp Manageengine Network Configuration Manager=12.5-build125453
Zohocorp Manageengine Network Configuration Manager=12.5-build125455
Zohocorp Manageengine Network Configuration Manager=12.5-build125456
Zohocorp Manageengine Network Configuration Manager=12.5-build125664
Zohocorp Manageengine Network Configuration Manager=12.6-build126000
Zohocorp Manageengine Network Configuration Manager=12.6-build126001
Zohocorp Manageengine Network Configuration Manager=12.6-build126100
Zohocorp Manageengine Network Configuration Manager=12.6-build126101
Zohocorp Manageengine Network Configuration Manager=12.6-build126102
Zohocorp Manageengine Network Configuration Manager=12.6-build126103
Zohocorp Manageengine Network Configuration Manager=12.6-build126113
Zohocorp Manageengine Network Configuration Manager=12.6-build126114
Zohocorp Manageengine Network Configuration Manager=12.6-build126115
Zohocorp Manageengine Network Configuration Manager=12.6-build126116
Zohocorp Manageengine Network Configuration Manager=12.6-build126117
Zohocorp ManageEngine OpManager=12.5-build125450
Zohocorp ManageEngine OpManager=12.5-build125451
Zohocorp ManageEngine OpManager=12.5-build125452
Zohocorp ManageEngine OpManager=12.5-build125453
Zohocorp ManageEngine OpManager=12.5-build125455
Zohocorp ManageEngine OpManager=12.5-build125456
Zohocorp ManageEngine OpManager=12.5-build125664
Zohocorp ManageEngine OpManager=12.6-build126000
Zohocorp ManageEngine OpManager=12.6-build126001
Zohocorp ManageEngine OpManager=12.6-build126100
Zohocorp ManageEngine OpManager=12.6-build126101
Zohocorp ManageEngine OpManager=12.6-build126102
Zohocorp ManageEngine OpManager=12.6-build126103
Zohocorp ManageEngine OpManager=12.6-build126113
Zohocorp ManageEngine OpManager=12.6-build126114
Zohocorp ManageEngine OpManager=12.6-build126115
Zohocorp ManageEngine OpManager=12.6-build126116
Zohocorp ManageEngine OpManager=12.6-build126117
Zohocorp Manageengine Opmanager Msp=12.5-build125450
Zohocorp Manageengine Opmanager Msp=12.5-build125656
Zohocorp Manageengine Opmanager Msp=12.5-build125664
Zohocorp Manageengine Opmanager Msp=12.6-build126000
Zohocorp Manageengine Opmanager Msp=12.6-build126001
Zohocorp Manageengine Opmanager Msp=12.6-build126100
Zohocorp Manageengine Opmanager Msp=12.6-build126103
Zohocorp Manageengine Opmanager Msp=12.6-build126113
Zohocorp Manageengine Opmanager Msp=12.6-build126117
ZohoCorp Manageengine Opmanager Plus=12.5-build125450
ZohoCorp Manageengine Opmanager Plus=12.5-build125656
ZohoCorp Manageengine Opmanager Plus=12.5-build125664
ZohoCorp Manageengine Opmanager Plus=12.6-build126000
ZohoCorp Manageengine Opmanager Plus=12.6-build126001
ZohoCorp Manageengine Opmanager Plus=12.6-build126100
ZohoCorp Manageengine Opmanager Plus=12.6-build126103
ZohoCorp Manageengine Opmanager Plus=12.6-build126113
ZohoCorp Manageengine Opmanager Plus=12.6-build126117
Zohocorp Manageengine Oputils=12.5-build125450
Zohocorp Manageengine Oputils=12.5-build125451
Zohocorp Manageengine Oputils=12.5-build125452
Zohocorp Manageengine Oputils=12.5-build125453
Zohocorp Manageengine Oputils=12.5-build125455
Zohocorp Manageengine Oputils=12.5-build125456
Zohocorp Manageengine Oputils=12.5-build125664
Zohocorp Manageengine Oputils=12.6-build126000
Zohocorp Manageengine Oputils=12.6-build126001
Zohocorp Manageengine Oputils=12.6-build126100
Zohocorp Manageengine Oputils=12.6-build126101
Zohocorp Manageengine Oputils=12.6-build126102
Zohocorp Manageengine Oputils=12.6-build126103
Zohocorp Manageengine Oputils=12.6-build126113
Zohocorp Manageengine Oputils=12.6-build126114
Zohocorp Manageengine Oputils=12.6-build126115
Zohocorp Manageengine Oputils=12.6-build126116
Zohocorp Manageengine Oputils=12.6-build126117

Event History

Aug 10, 2022
CVE Published
via MITRE·02:17 PM
Data Sourced
via MITRE·02:17 PM
Description
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-36923?

CVE-2022-36923 is classified as a critical vulnerability due to its potential to allow unauthorized access to API keys.

2

How do I fix CVE-2022-36923?

To remediate CVE-2022-36923, update your Zoho ManageEngine products to the latest versions released on or after July 27, 2022.

3

Which products are affected by CVE-2022-36923?

CVE-2022-36923 affects ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils.

4

What impact does CVE-2022-36923 have on my organization?

CVE-2022-36923 can lead to unauthorized access to sensitive data through API key exposure, posing risks to data integrity and confidentiality.

5

What steps should I take if I am vulnerable to CVE-2022-36923?

If vulnerable, immediately apply the necessary updates to your affected ManageEngine products to prevent exploitation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203