dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 13 Feb 2023. Known ransomware use
Manageengine Access Manager PlusApplication · Zohocorp

CVE-2022-47966

CRITICAL · 9.8 CVSS v3.1 Published 2023-01-18
Fix available
A fix is available. Upgrade to 4.3 / 5.1 or later.
See remediation →
100/100
Remediation priority · Urgent
In the wild Ransomware High EPSS Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a critical RCE vulnerability in multiple Zoho ManageEngine on-premise products stemming from the use of Apache Santuario xmlsec 1.4.1. The xmlsec library's XSLT features intentionally delegate certain security protections to the application layer, but ManageEngine failed to implement these protections, allowing unauthenticated remote attackers to execute arbitrary code via specially crafted XML/SAML payloads.

MitigationApply vendor patches to all affected ManageEngine products to the versions specified in the advisory (ServiceDesk Plus to 14004, ADSelfService Plus to 6211, etc.) and verify SAML SSO configuration status, as exploitation requires SAML SSO to have been configured at some point.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Manageengine Access Manager PlusApplication
Affected:< 4.3= 4.3
Manageengine Ad360Application
Affected:< 4.3= 4.3
Manageengine Adaudit PlusApplication
Affected:< 7.0= 7.0
Manageengine Admanager PlusApplication
Affected:< 7.1= 7.1
Manageengine Adselfservice PlusApplication
Affected:< 6.2= 6.2
Manageengine Analytics PlusApplication
Affected:< 5.1= 5.1
Manageengine AssetexplorerApplication
Affected:< 6.9= 6.9
Manageengine Key Manager PlusApplication
Affected:< 6.4= 6.4

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed ManageEngine product
    Locate the product by checking running services, installed programs, or the application's login page header. Common installation paths: C:\ManageEngine\ on Windows or /opt/ManageEngine/ on Linux.
    Affected if Any of the eight affected products (Access Manager Plus, Ad360, Adaudit Plus, Admanager Plus, Adselfservice Plus, Analytics Plus, Assetexplorer, Key Manager Plus) is installed.
  2. Determine the installed product version
    Access the product's About or Version section in the administration console, or check version.txt in the installation directory, or use the product's built-in version lookup (often available via /home page or help menu).
    Affected if The version matches any of the affected ranges: Access Manager Plus or Ad360 <= 4.3; Adaudit Plus <= 7.0; Admanager Plus <= 7.1; Adselfservice Plus <= 6.2; Analytics Plus <= 5.1; Assetexplorer <= 6.9; Key Manager Plus <= 6.4.
  3. Check if SAML SSO was ever configured
    Review the product's SAML configuration settings in the admin console under SSO or SAML settings. Look for any existing SAML identity provider (IdP) configurations, even if currently disabled.
    Affected if SAML SSO has been configured at any point (even if currently disabled or removed).
  4. Verify SAML SSO is currently active (if configured)
    In the product's SAML settings page, confirm whether SAML-based single sign-on is currently enabled and pointing to an IdP.
    Affected if SAML SSO is currently enabled and the product is in the affected version range.

A user is affected if they have any of the eight listed ManageEngine products installed in an affected version AND SAML SSO was configured at any point (the vulnerability exploits the xmlsec library's XSLT processing when SAML is or was enabled).

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.3 / 5.1 / 6.2 or later
Fixed in 4.35.16.2
Vendor patch www.manageengine.com →
Interim mitigation

Apply vendor patches to all affected ManageEngine products to the versions specified in the advisory (ServiceDesk Plus to 14004, ADSelfService Plus to 6211, etc.) and verify SAML SSO configuration status, as exploitation requires SAML SSO to have been configured at some point.

Recommended fix High confidence

Product-specific: Access Manager Plus 4308+, AD360 4310+, ADAudit Plus 7081+, ADManager Plus 7162+, ADSelfService Plus 6211+, Analytics Plus 5150+, Asset Explorer 6983+, Key Manager Plus 6401+

  1. 1. Identify which ManageEngine products are deployed in your environment from the affected products list
  2. 2. Verify if SAML SSO has ever been configured on the affected products (as exploitation requires this condition)
  3. 3. For Access Manager Plus: upgrade to version 4308 or later
  4. 4. For Active Directory 360 (AD360): upgrade to version 4310 or later
  5. 5. For ADAudit Plus: upgrade to version 7081 or later
  6. 6. For ADManager Plus: upgrade to version 7162 or later
  7. 7. For ADSelfService Plus: upgrade to version 6211 or later
  8. 8. For Analytics Plus: upgrade to version 5150 or later
Caveat Standard upgrade risk - test in non-production environment first; review release notes for any configuration changes required

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Manageengine Access Manager Plus Exploited in the wild — priority engagement
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-47966 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-47966 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data