CVE-2022-40771: Zohocorp ManageEngine Assetexplorer

Medium severity, CVSS 4.9. EPSS: 3.7% chance of exploitation in the next 30 days.

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

Affected products

• Zohocorp ManageEngine Assetexplorer: before 6.9 (fixed in 6.9); version 6.9 only
• Zohocorp ManageEngine ServiceDesk Plus: before 14.0 (fixed in 14.0); version 14.0 only
• Zohocorp ManageEngine ServiceDesk Plus Msp: before 13.0 (fixed in 13.0); version 13.0 only
• Zohocorp ManageEngine SupportCenter Plus: before 11.0 (fixed in 11.0); version 11.0 only

Published 2022-11-23. Last modified 2026-06-17.