CVE-2022-36923: Zohocorp ManageEngine Firewall Analyzer

High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Affected products

• Zohocorp ManageEngine Firewall Analyzer: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Netflow Analyzer: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Network Configuration Manager: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager Msp: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager Plus: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Oputils: version 12.5 only; version 12.6 only

Published 2022-08-10. Last modified 2026-06-17.