{"meta":{"title":"KEV entries: Zoho","description":"All KEV entries for vendor Zoho.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":9,"vendor":"Zoho","entries":9,"shareOfCatalogPercent":0.5,"ransomwareKnown":2,"firstDateAdded":"2021-11-03","latestDateAdded":"2023-03-07","rank":31},"data":[{"cveID":"CVE-2022-28810","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability","dateAdded":"2023-03-07","dueDate":"2023-03-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78","CWE-259"],"shortDescription":"Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-28810","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-28810"},{"cveID":"CVE-2022-47966","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","dateAdded":"2023-01-23","dueDate":"2023-02-13","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-47966","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-47966"},{"cveID":"CVE-2022-35405","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","dateAdded":"2022-09-22","dueDate":"2022-10-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-35405","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-35405"},{"cveID":"CVE-2021-44515","vendorProject":"Zoho","product":"Desktop Central","vulnerabilityName":"Zoho Desktop Central Authentication Bypass Vulnerability","dateAdded":"2021-12-10","dueDate":"2021-12-24","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44515","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-44515"},{"cveID":"CVE-2021-44077","vendorProject":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","vulnerabilityName":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","dateAdded":"2021-12-01","dueDate":"2021-12-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44077","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-44077"},{"cveID":"CVE-2021-37415","vendorProject":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP)","vulnerabilityName":"Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability","dateAdded":"2021-12-01","dueDate":"2021-12-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-37415","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-37415"},{"cveID":"CVE-2021-40539","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-55"],"shortDescription":"Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40539","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40539"},{"cveID":"CVE-2020-10189","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine Desktop Central File Upload Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-10189","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-10189"},{"cveID":"CVE-2019-8394","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-434"],"shortDescription":"Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-8394","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-8394"}]}