Zohocorp vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Zohocorp products: 47 record(s), with severity, exploitation and fixes.

Manageengine Exchange Reporter Plus 15 Manageengine Adselfservice Plus 7 Manageengine Password Manager Pro 4 Manageengine Endpoint Central 4 Manageengine Servicedesk Plus 4 Manageengine Pam360 4 Manageengine Admanager Plus 4 Endpoint Central 3 Manageengine Applications Manager 3 Manageengine Analytics Plus 3 Manageengine Access Manager Plus 3 Manageengine Servicedesk Plus Msp 2 Manageengine Supportcenter Plus 2 Manageengine Adaudit Plus 2 Manageengine Desktop Central 2 ManageEngine RecoveryManager Plus 2 ManageEngine OpManager 2 ManageEngine OpUtils 1 Manageengine Log360 1 ManageEngine Malware Protection Plus 1 ManageEngine DataSecurity Plus 1 Manageengine M365 Manager Plus 1 ManageEngine NetFlow Analyzer 1 Manageengine Patch Manager Plus 1 Zoho Mail wordpress plugin 1 Analytics Plus 1 Manageengine Vulnerability Manager Plus 1 Manageengine Remote Monitoring And Management Central 1 Manageengine Remote Access Plus 1 Manageengine Os Deployer 1 Manageengine Endpoint Dlp Plus 1 Manageengine Device Control Plus 1 Manageengine Browser Security Plus 1 Manageengine Application Control Plus 1 Manageengine Key Manager Plus 1 Manageengine Assetexplorer 1 Manageengine Ad360 1

Exploited only (KEV) →

CVE-2026-14308 Medium · 4.9 CWE-20 Oct 13, 2026

Insufficient Signature Validation

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

CVE-2026-11374 Critical · 9.0 CWE-287 Jun 23, 2026

ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus: predictable SSO ticket leading to account takeover (CVE-2026-11374)

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVE-2026-8174 Medium · 5.7 CWE-352 May 26, 2026

Cross-site Request Forgery

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

CVE-2026-2740 High · 8.4 CWE-77 May 21, 2026

Remote Code Execution

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

CVE-2026-3324 High · 8.2 CWE-288 Apr 16, 2026

Authentication Bypass

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.

CVE-2026-5785 High · 8.1 CWE-89 Apr 16, 2026

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

CVE-2026-27655 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

CVE-2026-4108 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.

CVE-2026-4107 Medium · 5.4 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.

CVE-2026-3880 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.

CVE-2026-3879 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.

CVE-2026-28703 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.

CVE-2026-28756 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.

CVE-2026-28754 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.

CVE-2026-1367 High · 8.3 CWE-89 Feb 23, 2026

Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.

CVE-2025-9226 Medium · 4.6 CWE-79 Jan 30, 2026

Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.

CVE-2025-9435 Medium · 5.5 CWE-22 Jan 13, 2026

Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

CVE-2025-11669 High · 8.1 CWE-862 Jan 13, 2026

Broken Access Control

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

CVE-2025-11250 Critical · 9.1 CWE-290 Jan 13, 2026

Authentication Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

CVE-2025-9787 Medium · 6.1 CWE-79 Dec 18, 2025

Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view.

CVE-2025-11670 Medium · 4.3 CWE-200 Dec 15, 2025

NTLM Hash Exposure Vulnerability

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.

CVE-2025-9227 Medium · 6.5 CWE-79 Nov 11, 2025

Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

CVE-2025-9223 High · 8.8 CWE-77 Nov 11, 2025

Command Injection

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

CVE-2025-8324 Critical · 9.8 CWE-89 Nov 11, 2025

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

CVE-2025-7633 Medium · 6.1 CWE-79 Nov 11, 2025

Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.