Zoho vulnerabilities
We track 110 vulnerabilities in Zoho products across 59 products. 108 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Zoho vulnerabilities
- 9.9 Critical severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope
- 8.1 High severity
ManageEngine OpManager: Execution with Unnecessary Privileges
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- 7.5 High severity
ManageEngine OpManager: Unquoted Search Path or Element
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an SQL Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- 7.6 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements Used in a Template Engine
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
- 8.1 High severity
DataSecurity Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.
- 7.5 High severity
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication…
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
- 8.8 High severity
ManageEngine Password Manager Pro: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
- 8.8 High severity
ManageEngine Password Manager Pro: Improper Verification of Cryptographic Signature
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
- 8.8 High severity
ManageEngine Password Manager Pro: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
- 8.5 High severity
ManageEngine M365 Manager Plus: Relative Path Traversal
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
- 9.0 Critical severity
manageengine_adselfservice_plus: Improper Authentication
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
- 8.4 High severity
ManageEngine ADSelfService Plus: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
- 8.2 High severity
ManageEngine Log360: Authentication Bypass Using an Alternate Path or Channel
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
- 8.1 High severity
ManageEngine PAM360: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
- 8.1 High severity
ManageEngine PAM360: Missing Authorization
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
- 8.8 High severity
ManageEngine Applications Manager: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
- 9.8 Critical severity
ManageEngine Analytics Plus: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
- 8.8 High severity
ManageEngine ADManager Plus: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
- 7.8 High severity
Endpoint Central: Improper Privilege Management
ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.
- 7.4 High severity
Analytics Plus: Use of Hard-coded Credentials
Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.
- 8.1 High severity
ADSelfService Plus: Improper Authentication
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.
- 8.1 High severity
Analytics Plus: Exposure of Sensitive Information to an Unauthorized Actor
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.
- 8.1 High severity
SharePoint Manager Plus: Improper Restriction of XML External Entity Reference
Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.
- 7.8 High severity
EndPoint Central: Improper Privilege Management
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
- 8.3 High severity
Endpoint Central: Incorrect Authorization
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15
- 8.8 High severity
Password Manager Pro: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulnerability via a global search option.
- 8.8 High severity
OpManager, Remote Monitoring and Management: Improper Control of Generation of Code
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.
- 8.3 High severity
OpManager: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.
- 8.8 High severity
DDI Central: Unrestricted Upload of File with Dangerous Type
Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.
- 8.8 High severity
Zoho Marketing Automation: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketing Automation: from n/a through 1.2.7.
- 7.2 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
- 8.1 High severity
PAM360: Incorrect Authorization
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerab
- 8.5 High severity
Zoho Campaigns: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.
- 8.8 High severity
ADAudit Plus: Improper Neutralization of Special Elements used in an SQL Command
ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and released in version 7271.
- 8.8 High severity
ADSelfService Plus: Improper Control of Generation of Code
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.