{"id":"CVE-2022-28810","published":"2022-04-18T13:15:08Z","modified":"2026-06-17T04:39:06Z","title":"Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability","vendor":"Zoho","product":"ManageEngine","tier":"core","eol":null,"description":{"text":"Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in the policy custom script feature of Zoho ManageEngine ADSelfService Plus, in builds before 6122, and allows arbitrary operating system commands to run as SYSTEM. An attacker with network access can reach it by authenticating as an administrator (a default administrator password may make this easy to obtain), or, in a separate path, by injecting commands through an unsanitized password field when only partially authenticated, with the exploit possibly requiring a user to interact with the product.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:21Z"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.70966,"percentile":0.99402,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-03-07","dueDate":"2023-03-28","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-28810","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-04-14","exploitedFirstSeen":"2022-04-14","ransomware":false,"evidence":[{"url":"https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/","date":"2022-04-14"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2022/11/eset_apt_activity_report_t22022.pdf","date":"2022-11-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-07"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://www.rapid7.com/globalassets/_pdfs/research/rapid7_2024_attack_intelligence_report.pdf","date":"2024-05-21"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-798","name":"Use of Hard-coded Credentials"},{"id":"CWE-259","name":"Use of Hard-coded Password"}],"references":[{"url":"http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/16475","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/","tags":["Exploit","Patch","Technical Description","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/16475","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/","tags":["Exploit","Patch","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-28810","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2022-28810 is a vulnerability that exists when custom password sync scripts are enabled when an adversary passes commands in the password field that can lead to remote code execution.","confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: default admin password enables valid account use","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Due to the use of a default administrator password, attackers may be able to abuse this functionality","start":190,"end":291}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary OS command execution as SYSTEM","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM","start":55,"end":151}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-33248","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33248","exploited":true,"exploitedSince":"2023-03-07","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"ManageEngine ADSelfService Plus Custom Script Execution","module":"exploit/windows/http/manageengine_adselfservice_plus_cve_2022_28810","type":"exploit","disclosureDate":"2022-04-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb"}],"first":{"date":"2022-04-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html","https://github.com/rapid7/metasploit-framework/pull/16475","https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2022-04-09","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb","provenance":"source"},{"date":"2022-04-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/","provenance":"source"},{"date":"2022-04-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28810","provenance":"source"},{"date":"2023-03-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33248","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":323},"priority":{"score":67.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1661 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.76,"detail":"base score 6.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}