CVE-2022-40770: Zohocorp ManageEngine ServiceDesk Plus

High severity, CVSS 7.2. EPSS: 81.3% chance of exploitation in the next 30 days.

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.

Affected products

• Zohocorp ManageEngine ServiceDesk Plus: before 13.0 (fixed in 13.0); version 13.0 only
• Zohocorp ManageEngine ServiceDesk Plus Msp: before 10.6 (fixed in 10.6); version 10.6 only
• Zohocorp ManageEngine SupportCenter Plus: before 11.0 (fixed in 11.0); version 11.0 only

Published 2022-11-23. Last modified 2026-06-17.