Zohocorp ManageEngine Analytics Plus vulnerabilities

8 CVEs affecting Zohocorp ManageEngine Analytics Plus, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-8324, published 2025-11-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability, published 2023-01-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-01-23. EPSS: 99.8% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because…
CVE-2025-9428, published 2025-10-21. High severity, CVSS 8.8. EPSS: 27.4% chance of exploitation in the next 30 days. Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
CVE-2020-21642, published 2022-08-15. Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days. Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.
CVE-2020-21641, published 2022-08-15. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via…
CVE-2025-8324, published 2025-11-11. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…
CVE-2024-52323, published 2024-11-27. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin…
CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…