Zohocorp vulnerabilities

Published CVEs affecting Zohocorp products: 86 record(s), with severity, exploitation and fixes.

Manageengine Exchange Reporter Plus 15 ManageEngine OpManager 13 Manageengine Adselfservice Plus 10 Manageengine Endpoint Central 9 Manageengine Applications Manager 9 ManageEngine Firewall Analyzer 7 Manageengine Pam360 7 Manageengine Password Manager Pro 7 DDI Central 5 Manageengine Access Manager Plus 4 Manageengine Servicedesk Plus 4 Manageengine Admanager Plus 4 ManageEngine DataSecurity Plus 3 Manageengine Analytics Plus 3 Manageengine Adaudit Plus 3 Endpoint Central 3 Manageengine M365 Manager Plus 2 Manageengine Log360 2 Manageengine Desktop Central 2 ManageEngine RecoveryManager Plus 2 ManageEngine NetFlow Analyzer 2 ManageEngine Network Configuration Manager 2 Manageengine Supportcenter Plus 2 Manageengine Servicedesk Plus Msp 2 ManageEngine OpUtils 1 Zoho Mail wordpress plugin 1 Analytics Plus 1 ManageEngine M365 Security Plus 1 Manageengine Ddi Central 1 ManageEngine EventLog Analyzer 1 Manageengine Vulnerability Manager Plus 1 ManageEngine Malware Protection Plus 1 Manageengine Remote Monitoring And Management Central 1 Manageengine Remote Access Plus 1 Manageengine Patch Manager Plus 1 Manageengine Os Deployer 1 Manageengine Endpoint Dlp Plus 1 Manageengine Device Control Plus 1 Manageengine Browser Security Plus 1 Manageengine Application Control Plus 1

Exploited only (KEV) →

CVE-2026-74849 Critical · 9.8 CWE-78 Sep 22, 2026

Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

CVE-2026-18912 High · 7.7 CWE-89 Sep 18, 2026

SQL Injection in Zohocorp ManageEngine DataSecurity Plus

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

CVE-2026-18911 High · 7.5 CWE-20 Sep 18, 2026

Improper Input Validation in Zohocorp ManageEngine DataSecurity Plus

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

CVE-2026-85640 Medium · 6.3 CWE-269 Sep 7, 2026

Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component

CVE-2026-77699 Medium · 5.0 CWE-269 Sep 7, 2026

Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.

CVE-2026-77697 Medium · 6.3 CWE-269 Sep 7, 2026

Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction

CVE-2026-77698 Medium · 5.7 CWE-269 Sep 7, 2026

Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.

CVE-2026-14828 High · 8.8 CWE-89 Sep 2, 2026

SQL Injection in Zohocorp Manageengine Password Manager Pro

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

CVE-2026-12263 High · 8.8 CWE-347 Aug 13, 2026

Authentication Bypass

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.

CVE-2026-11840 High · 8.8 CWE-89 Aug 13, 2026

SQL Injection

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

CVE-2026-12571 Critical · 9.8 CWE-287 Aug 11, 2026

Authentication Bypass Leading to Account Takeover

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

CVE-2026-16053 High · 8.5 CWE-23 Aug 11, 2026

Path Traversal

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

CVE-2026-6516 Critical · 10.0 CWE-78 Jul 23, 2026

Remote Code Execution

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

CVE-2026-3183 High · 7.1 CWE-290 Jul 21, 2026

Multi Factor Auth Bypass

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.

CVE-2026-3182 Medium · 4.3 CWE-319 Jul 21, 2026

Sensitive Data Exposure

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.

CVE-2026-11374 Critical · 9.0 CWE-287 Jun 23, 2026

ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus: predictable SSO ticket leading to account takeover (CVE-2026-11374)

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVE-2026-8174 Medium · 5.7 CWE-352 May 26, 2026

Cross-site Request Forgery

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

CVE-2026-2740 High · 8.4 CWE-77 May 21, 2026

Remote Code Execution

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

CVE-2026-3324 High · 8.2 CWE-288 Apr 16, 2026

Authentication Bypass

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.

CVE-2026-5785 High · 8.1 CWE-89 Apr 16, 2026

SQL Injection

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

CVE-2026-27655 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

CVE-2026-4108 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.

CVE-2026-4107 Medium · 5.4 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.

CVE-2026-3880 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.

CVE-2026-3879 Medium · 4.8 CWE-79 Apr 3, 2026

Stored XSS Vulnerability

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.