Zoho Corp Manageengine Opmanager

RCE in Zoho ManageEngine OpManager MSP <=12.8.709 Notification Profile
CVE-2026-19599 9.9 - Critical - September 23, 2026

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.

Shell injection

Auth Bypass in ZohoCorp ManageEngine OpManager <12.8.710 with AppMgr Plugin
CVE-2026-75825 8.8 - High - September 23, 2026

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.

Missing Authentication for Critical Function

Zoho ManageEngine OpManager <12.8.709: Cmd Injection via Diagnose Settings
CVE-2026-76978 8.8 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.

Shell injection

XML Injection in ZohoCorp OpManager <=12.8.709
CVE-2026-76979 7.7 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.

aka Blind XPath Injection

Data Exposure in ManageEngine Firewall Analyzer Syslog Collector 12.8.709
CVE-2026-76980 7.4 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.

Improper Input Validation

ZohoCorp OpMgr & FW Analyzer <12.8.710 Priv Esc via Report Profile Import
CVE-2026-84787 8.1 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.

Execution with Unnecessary Privileges

OpManager/Firewall Analyzer <=12.8.710: Broken Control - Unauthorized Alerts
CVE-2026-84789 7.1 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.

Insecure Direct Object Reference / IDOR

OpMgr <12.8.710: Broken AC Change Report Schedules
CVE-2026-84791 7.1 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.

Insecure Direct Object Reference / IDOR

OpManager & Net Config Manager <12.8.671 Path Traversal Vulnerability
CVE-2026-15358 7.5 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.

Unquoted Search Path or Element

ZohoCorp ManageEngine OpManager <=12.8.669 SQLi in Rule Mgmt Search Reports
CVE-2026-14913 8.8 - High - September 23, 2026

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.

SQL Injection

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing
CVE-2026-12370 7.6 - High - September 23, 2026

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.

1336

Stored XSS in Subnet Details of Zoho ManageEngine OpManager
CVE-2025-9226 4.6 - Medium - January 30, 2026

Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.

XSS

Stored XSS in SNMP Trap Processor of Zohocorp ManageEngine OpManager
CVE-2025-9227 6.5 - Medium - November 11, 2025

Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

XSS

ManageEngine OpManager RCE via Deploy Agent (CVE-2024-5466)
CVE-2024-5466 8.8 - High - August 23, 2024

Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.

Code Injection

Dir Traversal in uploadMib of ManageEngine OpManager 12.7.258
CVE-2023-47211 9.1 - Critical - January 08, 2024

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.

Directory traversal

Zoho OPManager RCE via Probe Servers (Auth)
CVE-2023-31099 8.8 - High - May 04, 2023

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.

Blind XXE SSRF in OpManager 12.6.168 Add UCS Device
CVE-2022-43473 5.4 - Medium - March 30, 2023

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

XXE

OpManager Auth RCE via DB Change in NMAP Feature
CVE-2022-38772 8.8 - High - August 29, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

Unauthenticated API Key Exposure in Zoho ManageEngine OpManager 2022
CVE-2022-36923 7.5 - High - August 10, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Improper Handling of Exceptional Conditions

Zoho ManageEngine OpManager Authenticated DB RCE
CVE-2022-37024 8.8 - High - August 10, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
CVE-2022-35404 8.2 - High - July 18, 2022

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

Improper Input Validation

Zoho ManageEngine OPManager through 125588
CVE-2022-29535 9.8 - Critical - May 05, 2022

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

SQL Injection

Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVE-2022-27908 8.8 - High - April 18, 2022

Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

SQL Injection

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
CVE-2021-44514 9.8 - Critical - December 09, 2021

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.

authentification

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module
CVE-2021-40493 9.8 - Critical - October 13, 2021

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.

SQL Injection

The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
CVE-2021-41075 9.8 - Critical - October 13, 2021

The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.

SQL Injection

Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
CVE-2021-41288 9.8 - Critical - September 30, 2021

Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.

SQL Injection

Zoho ManageEngine OpManager before 12.5.329
CVE-2021-3287 9.8 - Critical - April 22, 2021

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.

Marshaling, Unmarshaling

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component
CVE-2021-20078 - April 01, 2021

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)
CVE-2020-28653 9.8 - Critical - February 03, 2021

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation
CVE-2020-13818 7.5 - High - June 04, 2020

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

Directory traversal

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125
CVE-2020-12116 - May 07, 2020

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

Zoho ManageEngine OpManager before 125120
CVE-2020-11946 - April 20, 2020

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker
CVE-2020-11527 - April 04, 2020

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request
CVE-2020-10541 9.8 - Critical - March 13, 2020

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.

Improper Input Validation

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072
CVE-2019-17421 - November 21, 2019

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089
CVE-2019-17602 - October 15, 2019

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310
CVE-2019-15106 - August 16, 2019

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.

Multiple Zoho ManageEngine products suffer
CVE-2019-12133 7.8 - High - June 18, 2019

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.

Incorrect Permission Assignment for Critical Resource

Zoho ManageEngine OpManager 12.3 before build 123239
CVE-2018-20338 - December 21, 2018

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.

Zoho ManageEngine OpManager 12.3 before build 123239
CVE-2018-20339 - December 21, 2018

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.

Zoho ManageEngine OpManager 12.3 before 123238
CVE-2018-20173 - December 17, 2018

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
CVE-2018-19921 6.1 - Medium - December 06, 2018

Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.

XSS

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
CVE-2018-18716 - November 20, 2018

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
CVE-2018-18715 - November 20, 2018

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS
CVE-2018-19288 6.1 - Medium - November 15, 2018

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.

XSS

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214
CVE-2018-18980 7.5 - High - November 06, 2018

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

XXE

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection
CVE-2018-18949 9.8 - Critical - November 05, 2018

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

SQL Injection

Zoho ManageEngine OpManager before 12.3 build 123214
CVE-2018-18475 9.8 - Critical - October 23, 2018

Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.

Unrestricted File Upload

Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
CVE-2018-18262 6.1 - Medium - October 17, 2018

Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.

XSS