Zoho vulnerabilities
We track 110 vulnerabilities in Zoho products across 59 products. 108 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Zoho vulnerabilities
- 8.6 High severity
OpManager: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
- 8.8 High severity
Desktop Central: Server-Side Request Forgery
A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service en
- 8.1 High severity
Manageengine Ad360: Improper Authentication
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog A
- 7.5 High severity
manageengine_adaudit_plus: Incorrect Authorization
The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. NOTE: the vendor states "We do not consider this as a security bug and it's an exp
- 9.8 Critical severity
Manageengine Adselfservice Plus: Missing Authentication for Critical Functionality
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's
- 7.8 High severity
Zoho ManageEngine Multiple Products: Use of Hard-coded Credentials
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escal
- 7.5 High severity
Manageengine Assetexplorer: Uncontrolled Resource Consumption
Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).
- 8.8 High severity
Manageengine Desktop Central: Improper Limitation of a Pathname to a Restricted Directory
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restar
- 9.1 Critical severity
Manageengine Servicedesk Plus Msp: Improper Authentication
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
- 9.8 Critical severity
Zoho ManageEngine Multiple Products Remote Code Execution Exploited
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the a
- 7.8 High severity
manageengine_device_control_plus: Authentication Bypass Using an Alternate Path or Channel
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still poss
- 7.2 High severity
Manageengine Servicedesk Plus: Improper Neutralization of Special Elements used in a Command
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
- 9.8 Critical severity
Manageengine Access Manager Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.
- 8.8 High severity
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are…
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view.
- 9.8 Critical severity
Manageengine Access Manager Plus: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.
- 7.5 High severity
Manageengine Firewall Analyzer: Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a us
- 9.8 Critical severity
Manageengine Supportcenter Plus: Improper Authentication
In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with the credentials of a user who authenticated in the past.)
- 9.8 Critical severity
Zoho ManageEngine Multiple Products Remote Code Execution Exploited
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
- 8.2 High severity
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
- 7.2 High severity
ManageEngine AppManager15: Uncontrolled Search Path Element
ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.
- 9.8 Critical severity
Manageengine Access Manager Plus: Improper Limitation of a Pathname to a Restricted Directory
Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. a
- 8.8 High severity
Manageengine Adaudit Plus: Insufficiently Protected Credentials
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
- 6.8 Medium severity
Zoho ManageEngine ADSelfService Plus Remote Code Execution Exploited
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be a
- 8.8 High severity
Manageengine Adaudit Plus: Cleartext Transmission of Sensitive Information
Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response.
- 9.8 Critical severity
Zoho Desktop Central Authentication Bypass Exploited
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds
- 9.8 Critical severity
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts
- 9.8 Critical severity
Zoho ManageEngine ADSelfService Plus Authentication Bypass Exploited
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- 9.8 Critical severity
Zoho ManageEngine ServiceDesk Authentication Bypass Exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
- 9.8 Critical severity
Zoho ManageEngine Desktop Central File Upload Exploited
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
- 6.5 Medium severity
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Exploited
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.