CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Published Jan 18, 2023
·
Updated

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Other sources

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

— CISA

Affected Software

168 affected components
Zoho ManageEngine
Zohocorp Manageengine Access Manager Plus<4.3
Zohocorp Manageengine Access Manager Plus=4.3-build4300
Zohocorp Manageengine Access Manager Plus=4.3-build4301
Zohocorp Manageengine Access Manager Plus=4.3-build4302
Zohocorp Manageengine Access Manager Plus=4.3-build4303
Zohocorp Manageengine Access Manager Plus=4.3-build4304
Zohocorp Manageengine Access Manager Plus=4.3-build4305
Zohocorp Manageengine Access Manager Plus=4.3-build4306
Zohocorp Manageengine Access Manager Plus=4.3-build4307
Zohocorp Manageengine Ad360<4.3
Zohocorp Manageengine Ad360=4.3-4300
Zohocorp Manageengine Ad360=4.3-4302
Zohocorp Manageengine Ad360=4.3-4303
Zohocorp Manageengine Ad360=4.3-4304
Zohocorp Manageengine Ad360=4.3-4305
Zohocorp Manageengine Ad360=4.3-4306
Zohocorp Manageengine Ad360=4.3-4308
Zohocorp Manageengine Ad360=4.3-4309
Zohocorp ManageEngine ADAudit Plus<7.0
Zohocorp ManageEngine ADAudit Plus=7.0-7000
Zohocorp ManageEngine ADAudit Plus=7.0-7002
Zohocorp ManageEngine ADAudit Plus=7.0-7003
Zohocorp ManageEngine ADAudit Plus=7.0-7004
Zohocorp ManageEngine ADAudit Plus=7.0-7005
Zohocorp ManageEngine ADAudit Plus=7.0-7006
Zohocorp ManageEngine ADAudit Plus=7.0-7007
Zohocorp ManageEngine ADAudit Plus=7.0-7008
Zohocorp ManageEngine ADAudit Plus=7.0-7050
Zohocorp ManageEngine ADAudit Plus=7.0-7051
Zohocorp ManageEngine ADAudit Plus=7.0-7052
Zohocorp ManageEngine ADAudit Plus=7.0-7053
Zohocorp ManageEngine ADAudit Plus=7.0-7054
Zohocorp ManageEngine ADAudit Plus=7.0-7055
Zohocorp ManageEngine ADAudit Plus=7.0-7060
Zohocorp ManageEngine ADAudit Plus=7.0-7062
Zohocorp ManageEngine ADAudit Plus=7.0-7063
Zohocorp ManageEngine ADAudit Plus=7.0-7065
Zohocorp ManageEngine ADAudit Plus=7.0-7080
Zohocorp ManageEngine ADManager Plus<7.1
Zohocorp ManageEngine ADManager Plus=7.1-7100
Zohocorp ManageEngine ADManager Plus=7.1-7101
Zohocorp ManageEngine ADManager Plus=7.1-7102
Zohocorp ManageEngine ADManager Plus=7.1-7110
Zohocorp ManageEngine ADManager Plus=7.1-7111
Zohocorp ManageEngine ADManager Plus=7.1-7112
Zohocorp ManageEngine ADManager Plus=7.1-7113
Zohocorp ManageEngine ADManager Plus=7.1-7114
Zohocorp ManageEngine ADManager Plus=7.1-7115
Zohocorp ManageEngine ADManager Plus=7.1-7116
Zohocorp ManageEngine ADManager Plus=7.1-7117
Zohocorp ManageEngine ADManager Plus=7.1-7118
Zohocorp ManageEngine ADManager Plus=7.1-7120
Zohocorp ManageEngine ADManager Plus=7.1-7121
Zohocorp ManageEngine ADManager Plus=7.1-7122
Zohocorp ManageEngine ADManager Plus=7.1-7123
Zohocorp ManageEngine ADManager Plus=7.1-7124
Zohocorp ManageEngine ADManager Plus=7.1-7125
Zohocorp ManageEngine ADManager Plus=7.1-7126
Zohocorp ManageEngine ADManager Plus=7.1-7130
Zohocorp ManageEngine ADManager Plus=7.1-7131
Zohocorp ManageEngine ADManager Plus=7.1-7140
Zohocorp ManageEngine ADManager Plus=7.1-7141
Zohocorp ManageEngine ADManager Plus=7.1-7150
Zohocorp ManageEngine ADManager Plus=7.1-7151
Zohocorp ManageEngine ADManager Plus=7.1-7160
Zohocorp ManageEngine ADManager Plus=7.1-7161
Zohocorp ManageEngine ADSelfService Plus<6.2
Zohocorp ManageEngine ADSelfService Plus=6.2-6200
Zohocorp ManageEngine ADSelfService Plus=6.2-6201
Zohocorp ManageEngine ADSelfService Plus=6.2-6202
Zohocorp ManageEngine ADSelfService Plus=6.2-6203
Zohocorp ManageEngine ADSelfService Plus=6.2-6204
Zohocorp ManageEngine ADSelfService Plus=6.2-6205
Zohocorp ManageEngine ADSelfService Plus=6.2-6206
Zohocorp ManageEngine ADSelfService Plus=6.2-6207
Zohocorp ManageEngine ADSelfService Plus=6.2-6208
Zohocorp ManageEngine ADSelfService Plus=6.2-6209
Zohocorp ManageEngine ADSelfService Plus=6.2-6210
Zohocorp ManageEngine Analytics Plus<5.1
Zohocorp ManageEngine Analytics Plus=5.1-5100
Zohocorp ManageEngine Analytics Plus=5.1-5110
Zohocorp ManageEngine Analytics Plus=5.1-5120
Zohocorp ManageEngine Analytics Plus=5.1-5121
Zohocorp ManageEngine Analytics Plus=5.1-5130
Zohocorp ManageEngine Analytics Plus=5.1-5140
Zohocorp Manageengine Assetexplorer<6.9
Zohocorp Manageengine Assetexplorer=6.9-6900
Zohocorp Manageengine Assetexplorer=6.9-6901
Zohocorp Manageengine Assetexplorer=6.9-6902
Zohocorp Manageengine Assetexplorer=6.9-6903
Zohocorp Manageengine Assetexplorer=6.9-6904
Zohocorp Manageengine Assetexplorer=6.9-6905
Zohocorp Manageengine Assetexplorer=6.9-6906
Zohocorp Manageengine Assetexplorer=6.9-6907
Zohocorp Manageengine Assetexplorer=6.9-6908
Zohocorp Manageengine Assetexplorer=6.9-6909
Zohocorp Manageengine Assetexplorer=6.9-6950
Zohocorp Manageengine Assetexplorer=6.9-6951
Zohocorp Manageengine Assetexplorer=6.9-6952
Zohocorp Manageengine Assetexplorer=6.9-6953
Zohocorp Manageengine Assetexplorer=6.9-6954
Zohocorp Manageengine Assetexplorer=6.9-6955
Zohocorp Manageengine Assetexplorer=6.9-6956
Zohocorp Manageengine Assetexplorer=6.9-6957
Zohocorp Manageengine Assetexplorer=6.9-6970
Zohocorp Manageengine Assetexplorer=6.9-6971
Zohocorp Manageengine Assetexplorer=6.9-6972
Zohocorp Manageengine Assetexplorer=6.9-6973
Zohocorp Manageengine Assetexplorer=6.9-6974
Zohocorp Manageengine Assetexplorer=6.9-6975
Zohocorp Manageengine Assetexplorer=6.9-6976
Zohocorp Manageengine Assetexplorer=6.9-6977
Zohocorp Manageengine Assetexplorer=6.9-6978
Zohocorp Manageengine Assetexplorer=6.9-6979
Zohocorp Manageengine Assetexplorer=6.9-6980
Zohocorp Manageengine Assetexplorer=6.9-6981
Zohocorp Manageengine Assetexplorer=6.9-6982
Zohocorp Manageengine Key Manager Plus<6.4
Zohocorp Manageengine Key Manager Plus=6.4-6400
Zohocorp ManageEngine PAM360<5.7
Zohocorp ManageEngine PAM360=5.7-build5700
Zohocorp ManageEngine PAM360=5.7-build5710
Zohocorp ManageEngine PAM360=5.7-build5711
Zohocorp ManageEngine PAM360=5.7-build5712
Zohocorp ManageEngine Password Manager Pro<12.1
Zohocorp ManageEngine Password Manager Pro=12.1-build12100
Zohocorp ManageEngine Password Manager Pro=12.1-build12101
Zohocorp ManageEngine Password Manager Pro=12.1-build12110
Zohocorp ManageEngine Password Manager Pro=12.1-build12120
Zohocorp ManageEngine Password Manager Pro=12.1-build12121
Zohocorp ManageEngine Password Manager Pro=12.1-build12122
Zohocorp ManageEngine Password Manager Pro=12.1-build12123
Zohocorp ManageEngine ServiceDesk Plus<14.0
Zohocorp ManageEngine ServiceDesk Plus=14.0-14000
Zohocorp ManageEngine ServiceDesk Plus=14.0-14001
Zohocorp ManageEngine ServiceDesk Plus=14.0-14002
Zohocorp ManageEngine ServiceDesk Plus=14.0-14003
Zohocorp ManageEngine ServiceDesk Plus MSP<13.0
Zohocorp ManageEngine ServiceDesk Plus MSP=13.0-13000
Zohocorp Manageengine Supportcenter Plus=11.0-11017
Zohocorp Manageengine Supportcenter Plus=11.0-11018
Zohocorp Manageengine Supportcenter Plus=11.0-11019
Zohocorp Manageengine Supportcenter Plus=11.0-11020
Zohocorp Manageengine Supportcenter Plus=11.0-11021
Zohocorp Manageengine Supportcenter Plus=11.0-11022
Zohocorp Manageengine Supportcenter Plus=11.0-11024
Zohocorp Manageengine Supportcenter Plus=11.0-11025
Zohocorp Application Control Plus<=10.1.220.17
Zohocorp Manageengine Browser Security Plus<=11.1.2238.5
Zohocorp Manageengine Desktop Central<=10.1.2228.10
Zohocorp Manageengine Desktop Central<=10.1.2228.10
Zohocorp Manageengine Device Control Plus<=10.1.2220.17
Zohocorp Manageengine Endpoint Dlp Plus<=10.1.2137.5
Zohocorp Manageengine Os Deployer<=1.1.2243.0
Zohocorp Manageengine Patch Manager Plus<=10.1.2220.17
Zohocorp Manageengine Remote Access Plus<=10.1.2228.10
Zohocorp Manageengine Rmm Central<=10.1.40
Zohocorp Manageengine Vulnerability Manager Plus<=10.1.2220.17
Zohocorp Manageengine Application Control Plus<10.1.2220.18
Zohocorp Manageengine Browser Security Plus<11.1.2238.6
Zohocorp Manageengine Device Control Plus<10.1.2220.18
Zohocorp Manageengine Endpoint Dlp Plus<10.1.2137.6
Zohocorp Manageengine Os Deployer<1.1.2243.1
Zohocorp Manageengine Patch Manager Plus<10.1.2220.18
Zohocorp Manageengine Remote Access Plus<10.1.2228.11
Zohocorp Manageengine Remote Monitoring And Management Central<10.1.41
Zohocorp Manageengine Vulnerability Manager Plus<10.1.2220.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Zoho ManageEngine products (Apache Santuario xmlsec dependency) to a version that resolves this vulnerability.

    Fixed in 14004
  2. Upgrade

    Upgrade Zoho ManageEngine ServiceDesk Plus MSP to a version that resolves this vulnerability.

    Fixed in 13001
  3. Upgrade

    Upgrade Zoho ManageEngine SupportCenter Plus to a version that resolves this vulnerability.

    Fixed in 11026
  4. Upgrade

    Upgrade Zoho ManageEngine Vulnerability Manager Plus to a version that resolves this vulnerability.

    Fixed in 10.1.2220.18
  5. Upgrade

    Upgrade Zoho ManageEngine Access Manager Plus to a version that resolves this vulnerability.

    Fixed in 4308
  6. Upgrade

    Upgrade Zoho ManageEngine Active Directory to a version that resolves this vulnerability.

    Fixed in 360
  7. Upgrade

    Upgrade Zoho ManageEngine ADAudit Plus to a version that resolves this vulnerability.

    Fixed in 7081
  8. Upgrade

    Upgrade Zoho ManageEngine ADManager Plus to a version that resolves this vulnerability.

    Fixed in 7162
  9. Upgrade

    Upgrade Zoho ManageEngine ADSelfService Plus to a version that resolves this vulnerability.

    Fixed in 6211
  10. Upgrade

    Upgrade Zoho ManageEngine Analytics Plus to a version that resolves this vulnerability.

    Fixed in 5150
  11. Upgrade

    Upgrade Zoho ManageEngine Application Control Plus to a version that resolves this vulnerability.

    Fixed in 10.1.2220.18
  12. Upgrade

    Upgrade Zoho ManageEngine Asset Explorer to a version that resolves this vulnerability.

    Fixed in 6983
  13. Upgrade

    Upgrade Zoho ManageEngine Browser Security Plus to a version that resolves this vulnerability.

    Fixed in 11.1.2238.6
  14. Upgrade

    Upgrade Zoho ManageEngine Device Control Plus to a version that resolves this vulnerability.

    Fixed in 10.1.2220.18
  15. Upgrade

    Upgrade Zoho ManageEngine Endpoint Central to a version that resolves this vulnerability.

    Fixed in 10.1.2228.11
  16. Upgrade

    Upgrade Zoho ManageEngine Endpoint Central MSP to a version that resolves this vulnerability.

    Fixed in 10.1.2228.11
  17. Upgrade

    Upgrade Zoho ManageEngine Endpoint DLP to a version that resolves this vulnerability.

    Fixed in 10.1.2137.6
  18. Upgrade

    Upgrade Zoho ManageEngine Key Manager Plus to a version that resolves this vulnerability.

    Fixed in 6401
  19. Upgrade

    Upgrade Zoho ManageEngine OS Deployer to a version that resolves this vulnerability.

    Fixed in 1.1.2243.1
  20. Upgrade

    Upgrade Zoho ManageEngine PAM 360 to a version that resolves this vulnerability.

    Fixed in 5713
  21. Upgrade

    Upgrade Zoho ManageEngine Password Manager Pro to a version that resolves this vulnerability.

    Fixed in 12124
  22. Upgrade

    Upgrade Zoho ManageEngine Patch Manager Plus to a version that resolves this vulnerability.

    Fixed in 10.1.2220.18
  23. Upgrade

    Upgrade Zoho ManageEngine Remote Access Plus to a version that resolves this vulnerability.

    Fixed in 10.1.2228.11
  24. Upgrade

    Upgrade Zoho ManageEngine Remote Monitoring and Management (RMM) to a version that resolves this vulnerability.

    Fixed in 10.1.41
  25. Configuration

    Ensure SAML SSO is not configured for the product; for products where exploitation requires SAML SSO to be currently active, ensure SAML SSO is not active.

    Zoho ManageEngine SAML SSO configuration SAML SSO (has ever been configured / currently active) = Not configured or not active

Event History

Jan 18, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 23, 2023
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Sep 27, 2024
News Published
via BleepingComputer·03:09 PM
Oct 1, 2024
News Published
via BleepingComputer·03:11 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-47966?

CVE-2022-47966 has a critical severity rating due to its potential for remote code execution.

2

How do I fix CVE-2022-47966?

To fix CVE-2022-47966, update Zoho ManageEngine products to versions that address this vulnerability, specifically those patched after the affected versions.

3

Which products are affected by CVE-2022-47966?

CVE-2022-47966 affects multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus, Access Manager Plus, and ADAudit Plus, among others.

4

What type of vulnerability is CVE-2022-47966?

CVE-2022-47966 is classified as a remote code execution vulnerability.

5

Where can I find more information about CVE-2022-47966?

Detailed information about CVE-2022-47966 can typically be found in the official CVE database and vendor security advisories.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203