Zohocorp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-12265 Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL dHigh 8.8 · Sep 28, 2026
• CVE-2026-12264 Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code executioHigh 8.8 · Sep 28, 2026
• CVE-2026-12269 Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow.High 8.8 · Sep 28, 2026
• CVE-2026-12268 ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.High 8.8 · Sep 28, 2026
• CVE-2026-12267 ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code executHigh 7.2 · Sep 28, 2026
• CVE-2026-86708 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the ApplicatioCritical 10 · Sep 23, 2026
• CVE-2026-86683 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.High 8.1 · Sep 23, 2026
• CVE-2026-86681 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execHigh 7.6 · Sep 23, 2026
• CVE-2026-86679 ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delHigh 7.1 · Sep 23, 2026
• CVE-2026-86678 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform adHigh 8.8 · Sep 23, 2026
• CVE-2026-86677 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining adminisHigh 8.8 · Sep 23, 2026
• CVE-2026-76980 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslHigh 7.4 · Sep 23, 2026
• CVE-2026-76979 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking CompareHigh 7.7 · Sep 23, 2026
• CVE-2026-76978 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings High 8.8 · Sep 23, 2026
• CVE-2026-75825 ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerabilitHigh 8.8 · Sep 23, 2026
• CVE-2026-19599 ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.Critical 9.9 · Sep 23, 2026
• CVE-2026-84791 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheHigh 7.1 · Sep 23, 2026
• CVE-2026-84789 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheHigh 7.1 · Sep 23, 2026
• CVE-2026-84787 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenHigh 8.1 · Sep 23, 2026
• CVE-2026-15358 ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.High 7.5 · Sep 23, 2026
• CVE-2026-14913 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search ReHigh 8.8 · Sep 23, 2026
• CVE-2026-12370 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template InjecHigh 7.6 · Sep 23, 2026
• CVE-2026-75791 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.High 8.6 · Sep 22, 2026
• CVE-2026-74849 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.Critical 9.8 · Sep 22, 2026
• CVE-2026-18912 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execHigh 7.7 · Sep 18, 2026