Zohocorp ManageEngine Recovery Manager Plus vulnerabilities

2 CVEs affecting Zohocorp ManageEngine Recovery Manager Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11374, published 2026-06-23.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-9163, published 2018-04-02. Medium severity, CVSS 5.4. EPSS: 4.8% chance of exploitation in the next 30 days. A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject…
• CVE-2026-11374, published 2026-06-23. Critical severity, CVSS 9.0. EPSS: 2.5% chance of exploitation in the next 30 days. In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user,…