Zoho Corp ZoHo

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Zoho Corp product.

RSS Feeds for Zoho Corp security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Zoho Corp products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Zoho Corp Sorted by Most Security Vulnerabilities since 2018

Zoho Corp Manageengine Opmanager54 vulnerabilities

Zoho Corp Manageengine Adaudit Plus53 vulnerabilities

Zoho Corp Manageengine Adselfservice Plus48 vulnerabilities

Zoho Corp Manageengine Applications Manager47 vulnerabilities

Zoho Corp Manageengine Admanager Plus47 vulnerabilities

Zoho Corp Manageengine Servicedesk Plus42 vulnerabilities

Zoho Corp Manageengine Supportcenter Plus27 vulnerabilities

Zoho Corp Manageengine Servicedesk Plus Msp26 vulnerabilities

Zoho Corp Manageengine Exchange Reporter Plus25 vulnerabilities

Zoho Corp Manageengine Netflow Analyzer23 vulnerabilities

Zoho Corp Manageengine Password Manager Pro22 vulnerabilities

Zoho Corp Manageengine Pam36019 vulnerabilities

Zoho Corp Manageengine Network Configuration Manager15 vulnerabilities

Zoho Corp Manageengine Firewall Analyzer15 vulnerabilities

Zoho Corp Manageengine Access Manager Plus12 vulnerabilities

Zoho Corp Manageengine Key Manager Plus12 vulnerabilities

Zoho Corp Manageengine Eventlog Analyzer12 vulnerabilities

Zoho Corp Manageengine Log36011 vulnerabilities

Zoho Corp Manageengine Datasecurity Plus9 vulnerabilities

Zoho Corp Manageengine Endpoint Central8 vulnerabilities

Zoho Corp Manageengine Oputils8 vulnerabilities

Zoho Corp Manageengine Analytics Plus7 vulnerabilities

Zoho Corp Manageengine Opmanager Plus6 vulnerabilities

Zoho Corp Manageengine Opmanager Msp6 vulnerabilities

Zoho Corp Manageengine M365 Manager Plus6 vulnerabilities

Zoho Corp Manageengine Recoverymanager Plus5 vulnerabilities

Zoho Corp Manageengine Sharepoint Manager Plus5 vulnerabilities

Zoho Corp Ddi Central5 vulnerabilities

Zoho Corp Manageengine Application Control Plus4 vulnerabilities

Zoho Corp Endpoint Central3 vulnerabilities

Zoho Corp Log3603 vulnerabilities

Zoho Corp Manageengine Ddi Central3 vulnerabilities

Zoho Corp Manageengine M365 Security Plus3 vulnerabilities

Zoho Corp Eventlog Analyzer2 vulnerabilities

Zoho Corp Manageengine Remote Monitoring Management Central2 vulnerabilities

Zoho Corp Zoho Forms2 vulnerabilities

Zoho Corp Manageengine Supportcentre Plus1 vulnerability

Zoho Corp Zoho Mail Wordpress Plugin1 vulnerability

Zoho Corp Analytics Plus1 vulnerability

Zoho Corp Manageengine Malware Protection Plus1 vulnerability

By the Year

In 2026 there have been 69 vulnerabilities in Zoho Corp with an average score of 7.8 out of ten. Last year, in 2025 Zoho Corp had 31 security vulnerabilities published. That is, 38 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.37.

Year	Vulnerabilities	Average Score
2026	69	7.77
2025	31	6.40
2024	53	8.10
2023	46	6.91
2022	55	7.67
2021	96	8.63
2020	40	7.72
2019	58	7.53
2018	48	7.76

It may take a day or so for new Zoho Corp vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Zoho Corp Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-77690	Nov 04, 2026	ZohoCorp Key Manager Plus Authenticated Command Injection via Deploy Target ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.	Manageengine Key Manager Plus
CVE-2026-77779	Nov 04, 2026	ManageEngine Key Manager Plus Improper Access Control in Export Key Feature ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.	Manageengine Key Manager Plus
CVE-2026-77691	Nov 03, 2026	Auth Bypass via Malicious CA Assigner in ManageEngine Key Manager Plus ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA	Manageengine Key Manager Plus
CVE-2026-77778	Nov 03, 2026	Key Manager Plus Auth Export Privilege Escalation ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.	Manageengine Key Manager Plus
CVE-2026-77777	Nov 03, 2026	ManageEngine Key Manager Plus Improper Access Control on ACME Credentials ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.	Manageengine Key Manager Plus
CVE-2026-16900	Nov 03, 2026	ManageEngine Log360/ELA Authentication Bypass in Local Collector Registration Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.	Log360 Eventlog Analyzer
CVE-2026-13594	Nov 03, 2026	Zoho ManageEngine Log360/EVENTLOG Analyzer Unauthorized Access Vulnerability Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.	Log360 Eventlog Analyzer
CVE-2026-77800	Nov 03, 2026	Key Manager Plus SAML Auth Bypass via Cross-SP Assertion ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.	Manageengine Key Manager Plus
CVE-2026-77799	Nov 03, 2026	Key Manager Plus TFA Bypass Valid Credentials Grant Unverified Login ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.	Manageengine Key Manager Plus
CVE-2026-8923	Nov 02, 2026	Auth RCE via Log Forward in ManageEngine Eventlog Analyzer & Log360 Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.	Manageengine Eventlog Analyzer Manageengine Log360
CVE-2026-18199	Nov 02, 2026	Zohocorp ManageEngine Password Manager Pro & PAM360 Authenticated RCE Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.	Manageengine Password Manager Pro Manageengine Pam360
CVE-2026-14308	Oct 13, 2026	Zoho MBA+ <=1.0.64.12 Ins. Driver Signature Validation in MEARWService Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.	Manageengine Malware Protection Plus
CVE-2026-12265	Sep 28, 2026	Zohocorp DDI Central: HA Failover Endpoint ACL Flaw Enables Destructive DB Ops Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.	Ddi Central
CVE-2026-12264	Sep 28, 2026	Arbitrary File Write in ManageEngine DDI Central (pre-6201) RCE Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.	Ddi Central
CVE-2026-12267	Sep 28, 2026	ManageEngine DDI Central RCE via Windows DNS Query Injection ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.	Ddi Central
CVE-2026-12268	Sep 28, 2026	PowerShell Command Injection in ManageEngine DDI Central DNS SPF/TXT Push ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.	Ddi Central
CVE-2026-12269	Sep 28, 2026	Keepalived Config Injection in Zoho DDI Central <6.2.0 build 6201 Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.	Ddi Central
CVE-2026-92905	Sep 24, 2026	Zoho ManageEngine EventLog Analyzer DoS via malformed syslog packets ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets.	Manageengine Eventlog Analyzer Manageengine Log360
CVE-2026-86678	Sep 23, 2026	Low-Privileged User Can Retrieve Admin API Key in ManageEngine Apps Manager ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrators API key and use it to perform administrator-level actions.	Manageengine Applications Manager
CVE-2026-86677	Sep 23, 2026	Zoho ManageEngine Applications Manager SQL Injection (CVE-2026-86677) ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.	Manageengine Applications Manager
CVE-2026-86679	Sep 23, 2026	Privilege Bypass in ManageEngine AppsMgr Enables Low-Priv Delete of Service Monitors ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.	Manageengine Applications Manager
CVE-2026-86683	Sep 23, 2026	Low-Privileged Proxy Change in ManageEngine AppsMgr (Java) ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.	Manageengine Applications Manager
CVE-2026-86681	Sep 23, 2026	ZohoCorp ManageEngine Applications Manager: Low-Privileged MBean Action Escalation ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.	Manageengine Applications Manager
CVE-2026-86708	Sep 23, 2026	ZohoCorp ManageEngine App Manager GCP Key Leak Enables Unauth Impersonation ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.	Manageengine Applications Manager
CVE-2026-19599	Sep 23, 2026	RCE in Zoho ManageEngine OpManager MSP <=12.8.709 Notification Profile ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.	Manageengine Opmanager
CVE-2026-75825	Sep 23, 2026	Auth Bypass in ZohoCorp ManageEngine OpManager <12.8.710 with AppMgr Plugin ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.	Manageengine Opmanager
CVE-2026-76978	Sep 23, 2026	Zoho ManageEngine OpManager <12.8.709: Cmd Injection via Diagnose Settings ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-76979	Sep 23, 2026	XML Injection in ZohoCorp OpManager <=12.8.709 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-76980	Sep 23, 2026	Data Exposure in ManageEngine Firewall Analyzer Syslog Collector 12.8.709 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-84787	Sep 23, 2026	ZohoCorp OpMgr & FW Analyzer <12.8.710 Priv Esc via Report Profile Import ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-84789	Sep 23, 2026	OpManager/Firewall Analyzer <=12.8.710: Broken Control - Unauthorized Alerts ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-84791	Sep 23, 2026	OpMgr <12.8.710: Broken AC Change Report Schedules ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-15358	Sep 23, 2026	OpManager & Net Config Manager <12.8.671 Path Traversal Vulnerability ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.	Manageengine Opmanager Manageengine Network Configuration Manager
CVE-2026-14913	Sep 23, 2026	ZohoCorp ManageEngine OpManager <=12.8.669 SQLi in Rule Mgmt Search Reports ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.	Manageengine Opmanager Manageengine Firewall Analyzer
CVE-2026-12370	Sep 23, 2026	SSTI in Zoho ManageEngine OpManager 12.8.667 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.	Manageengine Opmanager Manageengine Netflow Analyzer Manageengine Network Configuration Manager And others...
CVE-2026-75791	Sep 22, 2026	Zohocorp ADSelfService Plus REST API Auth Bypass Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.	Manageengine Adselfservice Plus
CVE-2026-74849	Sep 22, 2026	Remote Code Execution via GINA Client in ManageEngine ADSelfService Plus Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.	Manageengine Adselfservice Plus
CVE-2026-18912	Sep 18, 2026	Auth SQLi in ManageEngine DataSecurity Plus Reports Module ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.	Manageengine Datasecurity Plus
CVE-2026-18911	Sep 18, 2026	DataSecurity Plus Agent Auth Bypass Pre6310 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.	Manageengine Datasecurity Plus
CVE-2026-77697	Sep 07, 2026	PrivEsc Vulnerability in Zohocorp Endpoint Central <11.4.2540.23 via JAR Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction	Manageengine Endpoint Central
CVE-2026-85640	Sep 07, 2026	ManageEngine Endpoint Central <=11.5.2600.15 PrivEsc via Outdated Component Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component	Manageengine Endpoint Central
CVE-2026-77699	Sep 07, 2026	Local Priv Escal in Zohocorp ManageEngine Endpoint Central <11.5.2605.01 DLL Load Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.	Manageengine Endpoint Central
CVE-2026-77698	Sep 07, 2026	Local Privilege Escalation in Zoho Endpoint Central <= 11.5.2605.01 Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.	Manageengine Endpoint Central
CVE-2026-14828	Sep 02, 2026	SQLi in Zohocorp ManageEngine Password Manager Pro <13235 Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.	Manageengine Password Manager Pro Manageengine Pam360 Manageengine Access Manager Plus And others...
CVE-2026-12263	Aug 13, 2026	Auth Bypass in ZOHOCorp Password Manager Pro via SAML Validation Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.	Manageengine Password Manager Pro Manageengine Pam360
CVE-2026-11840	Aug 13, 2026	Zohocorp ManageEngine Authenticated SQLi in Password Manager Pro & PAM360 Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.	Manageengine Password Manager Pro Manageengine Pam360
CVE-2026-12571	Aug 11, 2026	Auth Bypass in ManageEngine DDI Central Pwd Reset Flow An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.	Manageengine Ddi Central
CVE-2026-16053	Aug 11, 2026	Authenticated Path Traversal in Zohocorp ManageEngine M365 Manager Plus Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.	Manageengine M365 Manager Plus Manageengine M365 Security Plus
CVE-2026-6516	Jul 23, 2026	Unauth RCE via Agent API in ManageEngine ADAudit Plus <8606 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.	Manageengine Adaudit Plus
CVE-2026-3183	Jul 21, 2026	ManageEngine ADSelfService Plus MFA Bypass Vulnerability (CVE-2026-3183) Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.	Manageengine Adselfservice Plus