CVE-2022-43473: Zohocorp ManageEngine Opmanager

Medium severity, CVSS 5.4. EPSS: 19.8% chance of exploitation in the next 30 days.

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

Affected products

• Zohocorp ManageEngine Opmanager: before 12.6 (fixed in 12.6); version 12.6 only
• Zohocorp ManageEngine Opmanager Msp: before 12.6 (fixed in 12.6); version 12.6 only
• Zohocorp ManageEngine Opmanager Plus: before 12.6 (fixed in 12.6); version 12.6 only

Published 2023-03-30. Last modified 2026-06-17.