Zoho vulnerabilities
We track 110 vulnerabilities in Zoho products across 59 products. 108 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Zoho vulnerabilities
- 8.8 High severity
DDI Central: Improper Neutralization of Special Elements used in an OS Command
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute
- 8.1 High severity
DDI Central: Incorrect Authorization
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
- 8.1 High severity
DDI Central: Incorrect Authorization
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
- 8.1 High severity
DDI Central: Missing Authorization
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.
- 9.1 Critical severity
DDI Central: Missing Authentication for Critical Functionality
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS
- 8.8 High severity
DDI Central: Improper Neutralization of Special Elements used in an OS Command
Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.
- 9.9 Critical severity
M365 Manager Plus: Missing Authorization
Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could resu
- 9.1 Critical severity
AssetExplorer: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Re
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.
- 8.1 High severity
DDI Central: Improper Neutralization of Input During Web Page Generation
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
- 8.8 High severity
DDI Central: Improper Neutralization of Special Elements used in a Command
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
- 7.2 High severity
DDI Central: Improper Neutralization of Special Elements used in an SQL Command
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
- 7.6 High severity
DDI Central: Missing Authorization
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
- 7.5 High severity
DDI Central: Missing Authentication for Critical Functionality
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.
- 8.0 High severity
DDI Central: Improper Neutralization of Special Elements used in a Command
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially c
- 7.7 High severity
ManageEngine Key Manager Plus: Insufficient Granularity of Access Control
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
- 8.8 High severity
ManageEngine Key Manager Plus: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configur
- 7.1 High severity
ManageEngine Key Manager Plus: Insufficient Granularity of Access Control
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
- 7.1 High severity
ManageEngine Key Manager Plus: Insufficient Granularity of Access Control
ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
- 7.5 High severity
Log360: Improper Access Control
Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration req
- 9.1 Critical severity
Log360: Improper Access Control
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- 7.7 High severity
ManageEngine Key Manager Plus: Missing Critical Step in Authentication
ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.
- 7.4 High severity
ManageEngine Key Manager Plus: Authentication Bypass Using an Alternate Path or Channel
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.
- 8.7 High severity
ManageEngine Eventlog Analyzer: Improper Neutralization of Special Elements used in an OS Command
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.
- 8.8 High severity
ManageEngine Password Manager Pro: Improper Neutralization of Special Elements used in an OS Command
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
- 8.8 High severity
DDI Central: Improper Access Control
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
- 8.8 High severity
DDI Central: Unrestricted Upload of File with Dangerous Type
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
- 8.8 High severity
DDI Central: Improper Privilege Management
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially
- 8.8 High severity
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in…
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
- 7.2 High severity
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows…
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
- 10.0 Critical severity
ManageEngine Applications Manager: Use of Hard-coded Cryptographic Key
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service accou
- 7.6 High severity
ManageEngine Applications Manager: Missing Authentication for Critical Functionality
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
- 7.1 High severity
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a…
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
- 8.8 High severity
ManageEngine Applications Manager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- 8.8 High severity
ManageEngine Applications Manager: Improper Neutralization of Special Elements used in an SQL Command
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
- 7.4 High severity
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were…
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
- 7.7 High severity
ManageEngine OpManager: XML Injection
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- 8.8 High severity
ManageEngine OpManager: Missing Authentication for Critical Functionality
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.