Skip to content
Fencer Vulns
critical 9.8

CVE-2022-47966 kev+ ransomware in the critical feed json

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Sa…

published 2023-01-18 3 y ago modified 2026-07-31 3 mo ago also EUVD-2022-50684

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2023-01-23, used in ransomware
epss
99.8%
EPSS 99.8% chance of exploitation in 30 days, percentile 99.9%
public exploits
3
Metasploit, plus a Nuclei check

Summary

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Patch / fix

cisa required action Apply updates per vendor instructions.

  • zohocorp manageengine_access_manager_plus 4.3
  • zohocorp manageengine_ad360 4.3
  • zohocorp manageengine_adaudit_plus 7.0
  • zohocorp manageengine_admanager_plus 7.1
  • zohocorp manageengine_adselfservice_plus 6.2
  • zohocorp manageengine_analytics_plus 5.1
  • zohocorp manageengine_assetexplorer 6.9
  • zohocorp manageengine_key_manager_plus 6.4
  • zohocorp manageengine_pam360 5.7
  • zohocorp manageengine_password_manager_pro 12.1
  • zohocorp manageengine_servicedesk_plus 14.0
  • zohocorp manageengine_servicedesk_plus_msp 13.0
  • zohocorp manageengine_application_control_plus 10.1.2220.18
  • zohocorp manageengine_browser_security_plus 11.1.2238.6
  • zohocorp manageengine_device_control_plus 10.1.2220.18
  • zohocorp manageengine_endpoint_dlp_plus 10.1.2137.6
  • zohocorp manageengine_os_deployer 1.1.2243.1
  • zohocorp manageengine_patch_manager_plus 10.1.2220.18
  • zohocorp manageengine_remote_access_plus 10.1.2228.11
  • zohocorp manageengine_remote_monitoring_and_management_central 10.1.41

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-47966 updated cvss 8.1

ManageEngine: remote code execution vulnerability in multiple ManageEngine products

  • Red Hat Logging Subsystem for Red Hat OpenShift elasticsearch6-container Red Hat build of Apache Camel for Spring Boot 3 apache-santuario apache-santuario Red Hat Data Grid 8 apache-santuario apache-santuario Red Hat Fuse 7 apache-santuario apache-santuario Red Hat Integration Camel K 1 apache-santuario apache-santuario Red Hat Integration Camel Quarkus 1 apache-santuario apache-santuario
    +8 more products
    Red Hat JBoss Data Grid 7 apache-santuario apache-santuario Red Hat JBoss Data Virtualization 6 apache-santuario apache-santuario Red Hat JBoss Enterprise Application Platform 6 xmlsec Red Hat JBoss Enterprise Application Platform 7 xmlsec Red Hat JBoss Enterprise Application Platform Expansion Pack xmlsec Red Hat JBoss Fuse 6 apache-santuario apache-santuario Red Hat JBoss Fuse Service Works 6 apache-santuario apache-santuario Red Hat Single Sign-On 7 apache-santuario apache-santuario
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966)
  2. CISA SSVC: exploitation active
  3. Published
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
3 y ago
Patch by
2023-02-13 (3 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Zoho, ManageEngine
CISA name
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • Storm-0501 affiliate

reported by microsoft.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1068 Exploitation for Privilege Escalation primary impact
  • T1136.001 Local Account primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
3 y ago

Exploit prediction

99.75% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.