CVE-2019-19034: Zohocorp ManageEngine Assetexplorer

High severity, CVSS 7.2. EPSS: 6% chance of exploitation in the next 30 days.

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.

Affected products

• Zohocorp ManageEngine Assetexplorer: version 6.5 only

Published 2020-03-23. Last modified 2026-06-17.