CVE-2025-10020: Command Injection
Published Oct 21, 2025
·Updated
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
Affected Software
11 affected components
Zohocorp ManageEngine ADManager Plus<8024
Zohocorp ManageEngine ADManager Plus<8.0
Zohocorp ManageEngine ADManager Plus=8.0-8001
Zohocorp ManageEngine ADManager Plus=8.0-8002
Zohocorp ManageEngine ADManager Plus=8.0-8010
Zohocorp ManageEngine ADManager Plus=8.0-8011
Zohocorp ManageEngine ADManager Plus=8.0-8012
Zohocorp ManageEngine ADManager Plus=8.0-8020
Zohocorp ManageEngine ADManager Plus=8.0-8021
Zohocorp ManageEngine ADManager Plus=8.0-8022
Zohocorp ManageEngine ADManager Plus=8.0-8023
Event History
Oct 21, 2025
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-10020?
CVE-2025-10020 is classified as a high-severity authenticated command injection vulnerability.
2
How do I fix CVE-2025-10020?
You can fix CVE-2025-10020 by upgrading to version 8024 or later of Zohocorp ManageEngine ADManager Plus.
3
What component is affected by CVE-2025-10020?
CVE-2025-10020 affects the Custom Script component of Zohocorp ManageEngine ADManager Plus.
4
Is authentication required to exploit CVE-2025-10020?
Yes, an authenticated user is required to exploit the CVE-2025-10020 vulnerability.
5
Which versions of Zohocorp ManageEngine ADManager Plus are vulnerable to CVE-2025-10020?
All versions of Zohocorp ManageEngine ADManager Plus prior to 8024 are vulnerable to CVE-2025-10020.