Vendor

Zoho

9 of 11 Zoho CVEs in Patchfirst (82%) are in of vulnerabilities exploited in the wild, 2 of them used by ransomware.

CVEs: 11
In CISA KEV: 982%
Known ransomware use: 2
Median days to KEV: 78; from publication
Latest KEV listing: 7 Mar 2023

Watch Zoho Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
ManageEngine In KEV: 6 CVEs: 6
Desktop Central In KEV: 1 CVEs: 1
ManageEngine ServiceDesk Plus (SDP) In KEV: 1 CVEs: 1
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus In KEV: 1 CVEs: 1
ManageEngine ServiceDesk In KEV: 0 CVEs: 2

Top ATT&CK techniques

What attackers do with Zoho CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 7
T1505.003Web Shell CVEs: 3
T1003OS Credential Dumping CVEs: 3
T1059Command and Scripting Interpreter CVEs: 3
T1003.003NTDS CVEs: 2

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/zoho.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Zoho CVEs linked to the technique. Each link’s provenance is on the CVE page.

Zoho CVEs

11 CVEs, by priority

CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1136.001Local Account+1 more · 3 reports
99.8%Top 0.04%
87.6priority
CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1047Windows Management Instrumentation+11 more · 1 report
99.0%Top 0.07%
83.7priority
CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
Zoho · ManageEngineKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
99.9%Top 0.03%
73.7priority
CVE-2022-35405Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zoho · ManageEngineKEVPublic exploitCritical · 9.8T1059Command and Scripting Interpreter
99.9%Top 0.04%
69.9priority
CVE-2021-44515Zoho Desktop Central Authentication Bypass Vulnerability
Zoho · Desktop CentralKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1003OS Credential Dumping+3 more
99.9%Top 0.04%
69.9priority
CVE-2021-37415Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Zoho · ManageEngine ServiceDesk Plus (SDP)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application
99.8%Top 0.04%
69.9priority
CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1047Windows Management Instrumentation+11 more
93.3%Top 0.16%
69.8priority
CVE-2022-28810Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Zoho · ManageEngineKEVPublic exploitMedium · 6.8T1078Valid Accounts T1059Command and Scripting Interpreter
71.0%Top 0.6%
67.6priority
CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Zoho · ManageEngineKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing Application T1505.003Web Shell
63.3%Top 0.79%
67.4priority
CVE-2017-11512The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…
Zoho · ManageEngine ServiceDeskPublic exploit
79.6%Top 0.4%
59.9priority
CVE-2017-11511The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…
Zoho · ManageEngine ServiceDesk
3.6%Top 11%
52.9priority