CVE-2022-40772: Zohocorp ManageEngine Assetexplorer

Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days.

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module.

Affected products

• Zohocorp ManageEngine Assetexplorer: before 6.9 (fixed in 6.9); version 6.9 only
• Zohocorp ManageEngine ServiceDesk Plus: before 14.0 (fixed in 14.0); version 14.0 only
• Zohocorp ManageEngine ServiceDesk Plus Msp: before 10.6 (fixed in 10.6); version 10.6 only
• Zohocorp ManageEngine SupportCenter Plus: before 11.0 (fixed in 11.0); version 11.0 only

Published 2022-11-23. Last modified 2026-06-17.