ManageEngine vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-8309 There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter PHigh 8.1 · Aug 20, 2025
• CVE-2025-5966 Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.High 8.1 · Jun 26, 2025
• CVE-2025-5366 Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.High 8.1 · Jun 26, 2025
• CVE-2025-41444 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.High 8.3 · Jun 9, 2025
• CVE-2025-3835 Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.Critical 9.6 · Jun 9, 2025
• CVE-2025-36528 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.High 8.3 · Jun 9, 2025
• CVE-2025-27709 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.High 8.3 · Jun 9, 2025
• CVE-2025-41407 Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.High 8.3 · May 23, 2025
• CVE-2025-36527 Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.High 8.3 · May 23, 2025
• CVE-2025-41403 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.High 8.3 · May 22, 2025
• CVE-2025-3836 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.High 8.3 · May 22, 2025
• CVE-2025-3834 Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.High 8.1 · May 14, 2025
• CVE-2025-3833 Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.High 8.1 · May 14, 2025
• CVE-2025-1723 Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling.High 8.1 · Mar 3, 2025
• CVE-2024-41140 Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.High 8.1 · Jan 29, 2025
• CVE-2024-52323 Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive toHigh 8.1 · Nov 27, 2024
• CVE-2024-49574 Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.High 8.3 · Nov 18, 2024
• CVE-2024-10839 Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.High 8.5 · Nov 8, 2024
• CVE-2024-24409 Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.High 8.8 · Nov 8, 2024
• CVE-2024-10203 Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed mHigh 7 · Nov 7, 2024
• CVE-2024-9459 Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module.High 8.3 · Nov 5, 2024
• CVE-2024-36485 Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.High 8.3 · Nov 4, 2024
• CVE-2024-48878 Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.High 8.3 · Nov 4, 2024
• CVE-2024-5608 Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature.High 8.3 · Oct 24, 2024
• CVE-2024-38868 Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: beforeHigh 7.6 · Aug 30, 2024