Skip to content
OpenAdvisories

Vendor

Zohocorp

100 known vulnerabilities.

Products

ManageEngine Exchange Reporter Plus 15 ManageEngine OpManager 13 DDI Central 12 ManageEngine Applications Manager 9 ManageEngine Firewall Analyzer 7 ManageEngine Key Manager Plus 7 ManageEngine ADSelfService Plus 7 ManageEngine Password Manager Pro 6 ManageEngine PAM360 6 ManageEngine Endpoint Central 6 Log360 3 EventLog Analyzer 3 ManageEngine ADManager Plus 3 Endpoint Central 3 ManageEngine ADAudit Plus 2 ManageEngine Network Configuration Manager 2 ManageEngine DataSecurity Plus 2 manageengine_m365_manager_plus 2 ManageEngine Access Manager Plus 2 ADAudit Plus 2 ManageEngine NetFlow Analyzer 2 ManageEngine Log360 2 Analytics Plus 2 ManageEngine M365 Security Plus 1 ManageEngine OpUtils 1 ManageEngine Malware Protection Plus 1 ManageEngine Analytics Plus 1 ManageEngine RecoveryManager Plus 1 AssetExplorer 1 ServiceDesk Plus 1 ServiceDesk Plus MSP 1 SupportCenter Plus 1 M365 Manager Plus 1 Zoho Mail wordpress plugin 1 manageengine_ddi_central 1 manageengine_recovery_manager_plus 1 DataSecurity Plus 1 ManageEngine Eventlog Analyzer 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-12591

    Privilege Escalation

    Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could res…

    Zohocorp M365 Manager Plus
  • Critical 9.1
    CVE-2026-12507

    Authenticated remote code execution

    Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the R…

    Zohocorp AssetExplorer ServiceDesk Plus MSP ServiceDesk Plus
  • Critical 9.1
    CVE-2026-13594

    Improper Access Control vulnerability

    Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

    Zohocorp Log360 EventLog Analyzer
  • Critical 10.0
    CVE-2026-86708

    Sensitive data exposure

    ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service acco…

    Zohocorp ManageEngine Applications Manager
  • Critical 9.9
    CVE-2026-19599

    Remote Code Execution vulnerability

    ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.

    Zohocorp ManageEngine OpManager
  • Critical 9.8
    CVE-2026-74849

    Remote code execution vulnerability

    Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

    Zohocorp ManageEngine ADSelfService Plus
  • Critical 9.8
    CVE-2026-12571

    Authentication Bypass Leading to Account Takeover

    An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

    Zohocorp manageengine_ddi_central
  • Critical 10.0
    CVE-2026-6516 Public exploit

    Remote Code Execution

    Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

    Zohocorp ManageEngine ADAudit Plus
  • Critical 9.0
    CVE-2026-11374 Public exploit

    Account Takeover via Predictable SSO Ticket Generation

    In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

    Zohocorp ManageEngine ADSelfService Plus ManageEngine ADAudit Plus manageengine_m365_manager_plus
  • Critical 9.1
    CVE-2025-11250

    Authentication Bypass

    Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

    Zohocorp ManageEngine ADSelfService Plus
  • Critical 9.8
    CVE-2025-8324

    SQL Injection

    Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

    Zohocorp ManageEngine Analytics Plus