ManageEngine vulnerabilities
We track 20 vulnerabilities in ManageEngine products across 15 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest ManageEngine vulnerabilities
- 7.9 High severity
SharePoint Manager Plus: Missing Authorization
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration sett
- 8.5 High severity
SharePoint Manager Plus: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to
- 8.1 High severity
Asset Explorer: Improper Privilege Management
There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDes
- 8.1 High severity
ADSelfService Plus: Improper Authentication
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.
- 8.1 High severity
Analytics Plus: Exposure of Sensitive Information to an Unauthorized Actor
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.
- 8.1 High severity
SharePoint Manager Plus: Improper Restriction of XML External Entity Reference
Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.
- 7.8 High severity
EndPoint Central: Improper Privilege Management
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
- 8.3 High severity
Endpoint Central: Incorrect Authorization
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15
- 8.8 High severity
Password Manager Pro: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a global search option.
- 8.8 High severity
OpManager, Remote Monitoring and Management: Improper Control of Generation of Code
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.
- 8.3 High severity
OpManager: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.
- 8.8 High severity
DDI Central: Unrestricted Upload of File with Dangerous Type
Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.
- 7.2 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
- 8.1 High severity
PAM360: Incorrect Authorization
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerab
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and released in version 7271.
- 8.8 High severity
ADSelfService Plus: Improper Control of Generation of Code
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.
- 8.6 High severity
OpManager: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
- 8.8 High severity
Desktop Central: Server-Side Request Forgery
A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service en