ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2022-47966

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Published Jan 18, 2023 · catalog updated Jul 30, 2026 · Zoho ManageEngine

Patch now

CVE-2022-47966 is in the CISA known-exploited catalog, due Feb 13, 2023. Confirm Zoho ManageEngine against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Critical9.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
99.75%
Remediation
Remediation guidance
Affected products
cpe zohocorp/manageengine access manager plus · cpe zohocorp/manageengine ad360 · cpe zohocorp/manageengine adaudit plus · cpe zohocorp/manageengine admanager plus · cpe zohocorp/manageengine adselfservice plus · vendor Zoho ManageEngine

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe zohocorp/manageengine access manager plus4.3
  • cpe zohocorp/manageengine ad360version unspecified
  • cpe zohocorp/manageengine adaudit plusversion unspecified
  • cpe zohocorp/manageengine admanager plusversion unspecified
  • cpe zohocorp/manageengine adselfservice plusversion unspecified
  • vendor Zoho ManageEngineversion unspecified

How to fix CVE-2022-47966

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2022-47966 is in the CISA known-exploited catalog, due Feb 13, 2023. Confirm Zoho ManageEngine against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with zohocorp/manageengine access manager plus 4.3. Apply updates per vendor instructions.

What should an analyst verify?

CWE-20: Improper Input Validation. EPSS 99.75%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 18, 2023 · Catalog

    Detected

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects A

  2. Jan 23, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Feb 13, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jul 30, 2026 · Catalog

    Updated

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects A

Sources

  • AttackerKBCited referencehttps://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

    AttackerKB link already published on the finding.

    attackerkb.com
  • CISA KEVConfirmed exploitationCVE-2022-47966

    Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2022-47966

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-47966

    30-day exploitation probability 99.8%

    first.org
  • Metasploit ModulesPublic exploit moduleexploit_multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2022-47966

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm SecurityCited referencep://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm SecurityCited referencetp://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • VulnCheck KEVConfirmed exploitationCVE-2022-47966

    Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.