Zoho ManageEngine known exploited vulnerabilities, ranked
CISA lists 6 Zoho ManageEngine CVEs as exploited in the wild. 0 were added in the last 12 months and 2 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2020-10189: EPSS 99.94%, added 2021-11-03
- CVE-2022-35405: EPSS 99.93%, added 2022-09-22
- CVE-2022-47966: EPSS 99.75%, used in ransomware, added 2023-01-23
- CVE-2021-40539: EPSS 99.0%, used in ransomware, added 2021-11-03
- CVE-2022-28810: EPSS 71.0%, added 2023-03-07
All 6 Zoho ManageEngine CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2020-10189 | ManageEngine Desktop Central File Upload | 99.94% | – | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2022-35405 | ManageEngine Multiple Products Remote Code Execution | 99.93% | – | 2022-09-22 | 2022-10-13 |
| 3 | CVE-2022-47966 | ManageEngine Multiple Products Remote Code Execution | 99.75% | Yes | 2023-01-23 | 2023-02-13 |
| 4 | CVE-2021-40539 | ManageEngine ADSelfService Plus Authentication Bypass | 99.0% | Yes | 2021-11-03 | 2021-11-17 |
| 5 | CVE-2022-28810 | ManageEngine ADSelfService Plus Remote Code Execution | 71.0% | – | 2023-03-07 | 2023-03-28 |
| 6 | CVE-2019-8394 | ManageEngine ServiceDesk Plus (SDP) File Upload | 63.3% | – | 2021-11-03 | 2022-05-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Zoho KEV CVEs · free KEV badge for Zoho · all vendors