CVE-2020-15594: Zohocorp ManageEngine Application Control Plus

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product is deployed.

Affected products

• Zohocorp ManageEngine Application Control Plus: before 10.0.511 (fixed in 10.0.511)

Published 2020-09-30. Last modified 2026-06-17.