CVE-2019-11677: Zohocorp ManageEngine Firewall Analyzer

Critical severity, CVSS 9.8. EPSS: 9.4% chance of exploitation in the next 30 days.

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.

Affected products

• Zohocorp ManageEngine Firewall Analyzer: version 7.2 only; version 7.4 only; version 7.6 only; version 8.0 only; version 8.1 only; version 8.3 only; …

Published 2019-05-02. Last modified 2026-06-17.