Zohocorp ManageEngine Oputils vulnerabilities

9 CVEs affecting Zohocorp ManageEngine Oputils, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9226, published 2026-01-30.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-12998, published 2018-06-29. Medium severity, CVSS 6.1. EPSS: 99.3% chance of exploitation in the next 30 days. A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148,…
• CVE-2022-37024, published 2022-08-10. High severity, CVSS 8.8. EPSS: 79.5% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120)…
• CVE-2022-38772, published 2022-08-29. High severity, CVSS 8.8. EPSS: 78% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make…
• CVE-2023-47211, published 2024-01-08. High severity, CVSS 8.6. EPSS: 47% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can…
• CVE-2022-36923, published 2022-08-10. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002,…
• CVE-2018-12997, published 2018-06-29. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils…
• CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…
• CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…
• CVE-2025-9226, published 2026-01-30. Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days. Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.