CVE-2022-38772: Zohocorp ManageEngine Netflow Analyzer

High severity, CVSS 8.8. EPSS: 78% chance of exploitation in the next 30 days.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

Affected products

• Zohocorp ManageEngine Netflow Analyzer: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Network Configuration Manager: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager Msp: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Opmanager Plus: version 12.5 only; version 12.6 only
• Zohocorp ManageEngine Oputils: version 12.5 only; version 12.6 only

Published 2022-08-29. Last modified 2026-06-17.