CVE-2022-47966Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because th…
Updated under an hour ago ()
Does this affect you?
It affects zohocorp manageengine_access_manager_plus and 21 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jan 23, 2023; federal agencies had to remediate by Feb 13, 2023, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Added to CISA KEV Jan 23, 2023; federal remediation due Feb 13, 2023; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 99.75% (percentile 100)
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Jul 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
zohocorp manageengine_access_manager_plus zohocorp:manageengine_access_manager_plus | before 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; and 1 more ranges | NVD |
zohocorp manageengine_ad360 zohocorp:manageengine_ad360 | before 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; 4.3; and 1 more ranges | NVD |
zohocorp manageengine_adaudit_plus zohocorp:manageengine_adaudit_plus | before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; and 12 more ranges | NVD |
zohocorp manageengine_admanager_plus zohocorp:manageengine_admanager_plus | before 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; and 20 more ranges | NVD |
zohocorp manageengine_adselfservice_plus zohocorp:manageengine_adselfservice_plus | before 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; 6.2; and 4 more ranges | NVD |
zohocorp manageengine_analytics_plus zohocorp:manageengine_analytics_plus | before 5.1; 5.1; 5.1; 5.1; 5.1; 5.1; 5.1 | NVD |
zohocorp manageengine_assetexplorer zohocorp:manageengine_assetexplorer | before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; and 24 more ranges | NVD |
zohocorp manageengine_key_manager_plus zohocorp:manageengine_key_manager_plus | before 6.4; 6.4 | NVD |
zohocorp manageengine_pam360 zohocorp:manageengine_pam360 | before 5.7; 5.7; 5.7; 5.7; 5.7 | NVD |
zohocorp manageengine_password_manager_pro zohocorp:manageengine_password_manager_pro | before 12.1; 12.1; 12.1; 12.1; 12.1; 12.1; 12.1; 12.1 | NVD |
zohocorp manageengine_servicedesk_plus zohocorp:manageengine_servicedesk_plus | before 14.0; 14.0; 14.0; 14.0; 14.0 | NVD |
zohocorp manageengine_servicedesk_plus_msp zohocorp:manageengine_servicedesk_plus_msp | before 13.0; 13.0 | NVD |
zohocorp manageengine_supportcenter_plus zohocorp:manageengine_supportcenter_plus | 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; 11.0 | NVD |
zohocorp manageengine_application_control_plus zohocorp:manageengine_application_control_plus | before 10.1.2220.18 | NVD |
zohocorp manageengine_browser_security_plus zohocorp:manageengine_browser_security_plus | before 11.1.2238.6 | NVD |
zohocorp manageengine_device_control_plus zohocorp:manageengine_device_control_plus | before 10.1.2220.18 | NVD |
zohocorp manageengine_endpoint_dlp_plus zohocorp:manageengine_endpoint_dlp_plus | before 10.1.2137.6 | NVD |
zohocorp manageengine_os_deployer zohocorp:manageengine_os_deployer | before 1.1.2243.1 | NVD |
zohocorp manageengine_patch_manager_plus zohocorp:manageengine_patch_manager_plus | before 10.1.2220.18 | NVD |
zohocorp manageengine_remote_access_plus zohocorp:manageengine_remote_access_plus | before 10.1.2228.11 | NVD |
zohocorp manageengine_remote_monitoring_and_management_central zohocorp:manageengine_remote_monitoring_and_management_central | before 10.1.41 | NVD |
zohocorp manageengine_vulnerability_manager_plus zohocorp:manageengine_vulnerability_manager_plus | before 10.1.2220.18 | NVD |
References
- https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6release-notes
- https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.htmlpatch, vendor-advisory
- http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- https://blog.viettelcybersecurity.com/saml-show-stopper/exploit, third-party-advisory
- https://github.com/horizon3ai/CVE-2022-47966third-party-advisory
- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/exploit, third-party-advisory
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250athird-party-advisory, us-government-resource
- https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysisexploit, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.