Exploited
critical
9.8
CWE
20
Advisory Published
Updated

CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

First published: Wed Jan 18 2023(Updated: )

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
ManageEngine ServiceDesk Plus
ManageEngine Access Manager Plus<4.3
ManageEngine Access Manager Plus=4.3-build4300
ManageEngine Access Manager Plus=4.3-build4301
ManageEngine Access Manager Plus=4.3-build4302
ManageEngine Access Manager Plus=4.3-build4303
ManageEngine Access Manager Plus=4.3-build4304
ManageEngine Access Manager Plus=4.3-build4305
ManageEngine Access Manager Plus=4.3-build4306
ManageEngine Access Manager Plus=4.3-build4307
Zoho ManageEngine<4.3
Zoho ManageEngine=4.3-4300
Zoho ManageEngine=4.3-4302
Zoho ManageEngine=4.3-4303
Zoho ManageEngine=4.3-4304
Zoho ManageEngine=4.3-4305
Zoho ManageEngine=4.3-4306
Zoho ManageEngine=4.3-4308
Zoho ManageEngine=4.3-4309
Zoho ManageEngine ADAudit Plus<7.0
Zoho ManageEngine ADAudit Plus=7.0-7000
Zoho ManageEngine ADAudit Plus=7.0-7002
Zoho ManageEngine ADAudit Plus=7.0-7003
Zoho ManageEngine ADAudit Plus=7.0-7004
Zoho ManageEngine ADAudit Plus=7.0-7005
Zoho ManageEngine ADAudit Plus=7.0-7006
Zoho ManageEngine ADAudit Plus=7.0-7007
Zoho ManageEngine ADAudit Plus=7.0-7008
Zoho ManageEngine ADAudit Plus=7.0-7050
Zoho ManageEngine ADAudit Plus=7.0-7051
Zoho ManageEngine ADAudit Plus=7.0-7052
Zoho ManageEngine ADAudit Plus=7.0-7053
Zoho ManageEngine ADAudit Plus=7.0-7054
Zoho ManageEngine ADAudit Plus=7.0-7055
Zoho ManageEngine ADAudit Plus=7.0-7060
Zoho ManageEngine ADAudit Plus=7.0-7062
Zoho ManageEngine ADAudit Plus=7.0-7063
Zoho ManageEngine ADAudit Plus=7.0-7065
Zoho ManageEngine ADAudit Plus=7.0-7080
Zoho Corporation AdManager Plus<7.1
Zoho Corporation AdManager Plus=7.1-7100
Zoho Corporation AdManager Plus=7.1-7101
Zoho Corporation AdManager Plus=7.1-7102
Zoho Corporation AdManager Plus=7.1-7110
Zoho Corporation AdManager Plus=7.1-7111
Zoho Corporation AdManager Plus=7.1-7112
Zoho Corporation AdManager Plus=7.1-7113
Zoho Corporation AdManager Plus=7.1-7114
Zoho Corporation AdManager Plus=7.1-7115
Zoho Corporation AdManager Plus=7.1-7116
Zoho Corporation AdManager Plus=7.1-7117
Zoho Corporation AdManager Plus=7.1-7118
Zoho Corporation AdManager Plus=7.1-7120
Zoho Corporation AdManager Plus=7.1-7121
Zoho Corporation AdManager Plus=7.1-7122
Zoho Corporation AdManager Plus=7.1-7123
Zoho Corporation AdManager Plus=7.1-7124
Zoho Corporation AdManager Plus=7.1-7125
Zoho Corporation AdManager Plus=7.1-7126
Zoho Corporation AdManager Plus=7.1-7130
Zoho Corporation AdManager Plus=7.1-7131
Zoho Corporation AdManager Plus=7.1-7140
Zoho Corporation AdManager Plus=7.1-7141
Zoho Corporation AdManager Plus=7.1-7150
Zoho Corporation AdManager Plus=7.1-7151
Zoho Corporation AdManager Plus=7.1-7160
Zoho Corporation AdManager Plus=7.1-7161
ADSelfService Plus<6.2
ADSelfService Plus=6.2-6200
ADSelfService Plus=6.2-6201
ADSelfService Plus=6.2-6202
ADSelfService Plus=6.2-6203
ADSelfService Plus=6.2-6204
ADSelfService Plus=6.2-6205
ADSelfService Plus=6.2-6206
ADSelfService Plus=6.2-6207
ADSelfService Plus=6.2-6208
ADSelfService Plus=6.2-6209
ADSelfService Plus=6.2-6210
ManageEngine Analytics Plus<5.1
ManageEngine Analytics Plus=5.1-5100
ManageEngine Analytics Plus=5.1-5110
ManageEngine Analytics Plus=5.1-5120
ManageEngine Analytics Plus=5.1-5121
ManageEngine Analytics Plus=5.1-5130
ManageEngine Analytics Plus=5.1-5140
ManageEngine AssetExplorer<6.9
ManageEngine AssetExplorer=6.9-6900
ManageEngine AssetExplorer=6.9-6901
ManageEngine AssetExplorer=6.9-6902
ManageEngine AssetExplorer=6.9-6903
ManageEngine AssetExplorer=6.9-6904
ManageEngine AssetExplorer=6.9-6905
ManageEngine AssetExplorer=6.9-6906
ManageEngine AssetExplorer=6.9-6907
ManageEngine AssetExplorer=6.9-6908
ManageEngine AssetExplorer=6.9-6909
ManageEngine AssetExplorer=6.9-6950
ManageEngine AssetExplorer=6.9-6951
ManageEngine AssetExplorer=6.9-6952
ManageEngine AssetExplorer=6.9-6953
ManageEngine AssetExplorer=6.9-6954
ManageEngine AssetExplorer=6.9-6955
ManageEngine AssetExplorer=6.9-6956
ManageEngine AssetExplorer=6.9-6957
ManageEngine AssetExplorer=6.9-6970
ManageEngine AssetExplorer=6.9-6971
ManageEngine AssetExplorer=6.9-6972
ManageEngine AssetExplorer=6.9-6973
ManageEngine AssetExplorer=6.9-6974
ManageEngine AssetExplorer=6.9-6975
ManageEngine AssetExplorer=6.9-6976
ManageEngine AssetExplorer=6.9-6977
ManageEngine AssetExplorer=6.9-6978
ManageEngine AssetExplorer=6.9-6979
ManageEngine AssetExplorer=6.9-6980
ManageEngine AssetExplorer=6.9-6981
ManageEngine AssetExplorer=6.9-6982
ManageEngine Key Manager Plus<6.4
ManageEngine Key Manager Plus=6.4-6400
ManageEngine PAM360<5.7
ManageEngine PAM360=5.7-build5700
ManageEngine PAM360=5.7-build5710
ManageEngine PAM360=5.7-build5711
ManageEngine PAM360=5.7-build5712
ManageEngine Password Manager Pro<12.1
ManageEngine Password Manager Pro=12.1-build12100
ManageEngine Password Manager Pro=12.1-build12101
ManageEngine Password Manager Pro=12.1-build12110
ManageEngine Password Manager Pro=12.1-build12120
ManageEngine Password Manager Pro=12.1-build12121
ManageEngine Password Manager Pro=12.1-build12122
ManageEngine Password Manager Pro=12.1-build12123
ManageEngine ServiceDesk Plus<14.0
ManageEngine ServiceDesk Plus=14.0-14000
ManageEngine ServiceDesk Plus=14.0-14001
ManageEngine ServiceDesk Plus=14.0-14002
ManageEngine ServiceDesk Plus=14.0-14003
ManageEngine ServiceDesk Plus MSP<13.0
ManageEngine ServiceDesk Plus MSP=13.0-13000
ManageEngine SupportCenter Plus=11.0-11017
ManageEngine SupportCenter Plus=11.0-11018
ManageEngine SupportCenter Plus=11.0-11019
ManageEngine SupportCenter Plus=11.0-11020
ManageEngine SupportCenter Plus=11.0-11021
ManageEngine SupportCenter Plus=11.0-11022
ManageEngine SupportCenter Plus=11.0-11024
ManageEngine SupportCenter Plus=11.0-11025
Zoho ManageEngine Application Control Plus<10.1.220.18
ManageEngine Browser Security Plus<11.1.2238.6
ManageEngine Device Control Plus<10.1.2220.18
ZohoCorp ManageEngine Device Control Plus<10.1.2137.6
ManageEngine OS Deployer<1.1.2243.1
ManageEngine Patch Manager Plus by Zoho Corporation<10.1.2220.18
Zoho ManageEngine Remote Access Plus<10.1.2228.11
ManageEngine Remote Monitoring and Management<10.1.41
ManageEngine Vulnerability Manager Plus<10.1.2220.18
Zoho ManageEngine Application Control Plus<=10.1.220.17
ManageEngine Browser Security Plus<=11.1.2238.5
ManageEngine Desktop Central<=10.1.2228.10
ManageEngine Desktop Central<=10.1.2228.10
ManageEngine Device Control Plus<=10.1.2220.17
ZohoCorp ManageEngine Device Control Plus<=10.1.2137.5
ManageEngine OS Deployer<=1.1.2243.0
ManageEngine Patch Manager Plus by Zoho Corporation<=10.1.2220.17
Zoho ManageEngine Remote Access Plus<=10.1.2228.10
ManageEngine RMM Central<=10.1.40
ManageEngine Vulnerability Manager Plus<=10.1.2220.17

Remedy

https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2022-47966?

    CVE-2022-47966 has a critical severity rating due to its potential for remote code execution.

  • How do I fix CVE-2022-47966?

    To fix CVE-2022-47966, update Zoho ManageEngine products to versions that address this vulnerability, specifically those patched after the affected versions.

  • Which products are affected by CVE-2022-47966?

    CVE-2022-47966 affects multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus, Access Manager Plus, and ADAudit Plus, among others.

  • What type of vulnerability is CVE-2022-47966?

    CVE-2022-47966 is classified as a remote code execution vulnerability.

  • Where can I find more information about CVE-2022-47966?

    Detailed information about CVE-2022-47966 can typically be found in the official CVE database and vendor security advisories.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203