Zohocorp ManageEngine Firewall Analyzer vulnerabilities

19 CVEs affecting Zohocorp ManageEngine Firewall Analyzer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76980, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-37024, published 2022-08-10. High severity, CVSS 8.8. EPSS: 79.5% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120)…
CVE-2023-47211, published 2024-01-08. High severity, CVSS 8.6. EPSS: 47% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can…
CVE-2015-7780, published 2017-06-27. Medium severity, CVSS 6.5. EPSS: 10.6% chance of exploitation in the next 30 days. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
CVE-2019-11678, published 2019-05-02. Critical severity, CVSS 9.8. EPSS: 9.5% chance of exploitation in the next 30 days. The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
CVE-2019-11677, published 2019-05-02. Critical severity, CVSS 9.8. EPSS: 9.4% chance of exploitation in the next 30 days. The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
CVE-2022-36923, published 2022-08-10. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002,…
CVE-2015-7781, published 2017-06-27. High severity, CVSS 7.5. EPSS: 7.1% chance of exploitation in the next 30 days. ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
CVE-2017-14123, published 2017-09-04. High severity, CVSS 8.8. EPSS: 6.1% chance of exploitation in the next 30 days. Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the…
CVE-2026-76978, published 2026-09-23. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
CVE-2022-35404, published 2022-07-18. High severity, CVSS 8.2. EPSS: 2.9% chance of exploitation in the next 30 days. ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

Latest

CVE-2026-76980, published 2026-09-23. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
CVE-2026-76979, published 2026-09-23. High severity, CVSS 7.7. EPSS: 1.1% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
CVE-2026-84791, published 2026-09-23. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify…
CVE-2026-84789, published 2026-09-23. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create…
CVE-2026-84787, published 2026-09-23. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain…
CVE-2026-14913, published 2026-09-23. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…