Brand

ManageEngine (Zoho): actively exploited vulnerabilities

9 vulnerabilities in ManageEngine (Zoho) products (ServiceDesk Plus, ADSelfService Plus, Endpoint Central (ex-Desktop Central)…) are in CISA’s catalog of exploited vulnerabilities. Last added: March 7, 2023.

ManageEngine (Zoho) security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

0 vulnerabilities added in the last 12 months
9 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one ManageEngine (Zoho) category to your radar, or open its page.

Monitoring, ITSM and asset management 6 vulnerabilities
Identity and access 3 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

ServiceDesk Plus 3 vulnerabilities · Monitoring and ITSM
ADSelfService Plus 2 vulnerabilities · Identity and access
Endpoint Central (ex-Desktop Central) 2 vulnerabilities · Monitoring and ITSM
PAM360 / Password Manager Pro 1 vulnerability · Identity and access
Multiple products 1 vulnerability · Monitoring and ITSM

Name used by CISA: Zoho. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this ManageEngine (Zoho) list.

Rank 1ManageEngine (Zoho) Multiple products
CVE-2022-47966
Ransomware
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 23, 2023
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 2ManageEngine (Zoho) PAM360 / Password Manager Pro
CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 22, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3ManageEngine (Zoho) Endpoint Central (ex-Desktop Central)
CVE-2021-44515
Zoho Desktop Central Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Dec 10, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 4ManageEngine (Zoho) ServiceDesk Plus
CVE-2021-37415
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Dec 1, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 5ManageEngine (Zoho) ServiceDesk Plus
CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Dec 1, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 6ManageEngine (Zoho) Endpoint Central (ex-Desktop Central)
CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 7ManageEngine (Zoho) ADSelfService Plus
CVE-2021-40539
Ransomware
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 8ManageEngine (Zoho) ADSelfService Plus
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 7, 2023
CISA deadline
21 days
CVSS severity
6.8 (medium)
Rank 9ManageEngine (Zoho) ServiceDesk Plus
CVE-2019-8394
CVE from 2019, added in 2021
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
6.5 (medium)

Get new ManageEngine (Zoho) vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

By category

Affected products

Patch first

Follow and verify