Zohocorp ManageEngine Network Configuration Manager vulnerabilities

16 CVEs affecting Zohocorp ManageEngine Network Configuration Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15358, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-12998, published 2018-06-29. Medium severity, CVSS 6.1. EPSS: 99.3% chance of exploitation in the next 30 days. A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148,…
CVE-2022-37024, published 2022-08-10. High severity, CVSS 8.8. EPSS: 79.5% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120)…
CVE-2022-38772, published 2022-08-29. High severity, CVSS 8.8. EPSS: 78% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make…
CVE-2021-41081, published 2021-11-11. Critical severity, CVSS 9.8. EPSS: 64.1% chance of exploitation in the next 30 days. Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.
CVE-2023-47211, published 2024-01-08. High severity, CVSS 8.6. EPSS: 47% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can…
CVE-2018-18980, published 2018-11-06. High severity, CVSS 7.5. EPSS: 25% chance of exploitation in the next 30 days. An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a…
CVE-2021-43319, published 2021-11-30. Critical severity, CVSS 9.8. EPSS: 21.4% chance of exploitation in the next 30 days. Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.
CVE-2022-36923, published 2022-08-10. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002,…
CVE-2018-12997, published 2018-06-29. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils…
CVE-2021-41080, published 2021-11-11. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.

Latest

CVE-2026-15358, published 2026-09-23. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
CVE-2026-12370, published 2026-09-23. High severity, CVSS 7.6. EPSS: 1.5% chance of exploitation in the next 30 days. ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet…
CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…
CVE-2023-29505, published 2023-08-04. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking.
CVE-2022-35404, published 2022-07-18. High severity, CVSS 8.2. EPSS: 2.9% chance of exploitation in the next 30 days. ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.