{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Zoho vulnerabilities","home_page_url":"https://patchfirst.co/vendor/zoho/","feed_url":"https://patchfirst.co/feed/vendor/zoho.json","description":"New and newly exploited Zoho CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2022-28810#kev","url":"https://patchfirst.co/cve/CVE-2022-28810/","title":"[KEV] CVE-2022-28810: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2023-03-07. ENISA EUVD lists it as exploited. EPSS 71.0% (higher than 99.4% of CVEs). CVSS 6.8 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 67.6 of 100.","summary":"Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability","date_published":"2023-03-07T00:00:00.000Z","date_modified":"2026-06-17T04:39:06.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":67.6,"kev":{"dateAdded":"2023-03-07","ransomware":false},"epss":{"score":0.70966,"percentile":0.99402},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-47966#kev","url":"https://patchfirst.co/cve/CVE-2022-47966/","title":"[KEV] CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2023-01-23, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation; T1136.001 Local Account. Named in 3 threat reports. Priority 87.6 of 100.","summary":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","date_published":"2023-01-23T00:00:00.000Z","date_modified":"2026-07-31T04:16:41.000Z","tags":["kev","ransomware","public-exploit","T1190","T1068","T1136.001"],"_patchfirst":{"reason":"kev","priority":87.6,"kev":{"dateAdded":"2023-01-23","ransomware":true},"epss":{"score":0.99753,"percentile":0.99955},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1068","T1136.001"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-35405#kev","url":"https://patchfirst.co/cve/CVE-2022-35405/","title":"[KEV] CVE-2022-35405: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2022-09-22. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","date_published":"2022-09-22T00:00:00.000Z","date_modified":"2026-06-17T04:51:46.000Z","tags":["kev","public-exploit","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-09-22","ransomware":false},"epss":{"score":0.99873,"percentile":0.99963},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44515","url":"https://patchfirst.co/cve/CVE-2021-44515/","title":"CVE-2021-44515: Zoho Desktop Central Authentication Bypass Vulnerability","content_text":"Zoho · Desktop Central. In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer; T1003 OS Credential Dumping; T1069 Permission Groups Discovery; T1087 Account Discovery. Priority 69.9 of 100.","summary":"Zoho Desktop Central Authentication Bypass Vulnerability","date_published":"2021-12-12T00:00:00.000Z","date_modified":"2026-06-17T04:12:29.000Z","tags":["kev","public-exploit","T1190","T1105","T1003","T1069","T1087"],"_patchfirst":{"reason":"published","priority":69.9,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.99871,"percentile":0.99963},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"Desktop Central","techniqueIds":["T1190","T1105","T1003","T1069","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-37415#kev","url":"https://patchfirst.co/cve/CVE-2021-37415/","title":"[KEV] CVE-2021-37415: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability","content_text":"Zoho · ManageEngine ServiceDesk Plus (SDP). In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 69.9 of 100.","summary":"Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T04:00:29.000Z","tags":["kev","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.99825,"percentile":0.9996},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP)","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44077#kev","url":"https://patchfirst.co/cve/CVE-2021-44077/","title":"[KEV] CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T04:11:52.000Z","tags":["kev","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.93298,"percentile":0.99836},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40539#kev","url":"https://patchfirst.co/cve/CVE-2021-40539/","title":"[KEV] CVE-2021-40539: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.","summary":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:07:06.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9896,"percentile":0.99929},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-10189#kev","url":"https://patchfirst.co/cve/CVE-2020-10189/","title":"[KEV] CVE-2020-10189: Zoho ManageEngine Desktop Central File Upload Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 73.7 of 100.","summary":"Zoho ManageEngine Desktop Central File Upload Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:47:27.000Z","tags":["kev","public-exploit","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99941,"percentile":0.99972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1059","T1190"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-8394#kev","url":"https://patchfirst.co/cve/CVE-2019-8394/","title":"[KEV] CVE-2019-8394: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 63.3% (higher than 99.21% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 67.4 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:41:56.000Z","tags":["kev","public-exploit","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.63336,"percentile":0.99206},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-11512","url":"https://patchfirst.co/cve/CVE-2017-11512/","title":"CVE-2017-11512: The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…","content_text":"Zoho · ManageEngine ServiceDesk. Not in CISA KEV. EPSS 79.6% (higher than 99.61% of CVEs). Public exploit code exists. Priority 59.9 of 100.","summary":"The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…","date_published":"2017-11-08T00:00:00.000Z","date_modified":"2024-09-16T17:02:50.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":59.9,"kev":null,"epss":{"score":0.79604,"percentile":0.99605},"cvss":null,"vendor":"Zoho","product":"ManageEngine ServiceDesk","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2017-11511","url":"https://patchfirst.co/cve/CVE-2017-11511/","title":"CVE-2017-11511: The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…","content_text":"Zoho · ManageEngine ServiceDesk. Not in CISA KEV. EPSS 3.6% (higher than 89.3% of CVEs). Priority 52.9 of 100.","summary":"The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…","date_published":"2017-11-08T00:00:00.000Z","date_modified":"2024-09-17T03:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":52.9,"kev":null,"epss":{"score":0.03569,"percentile":0.89346},"cvss":null,"vendor":"Zoho","product":"ManageEngine ServiceDesk","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}