CVE-2022-47966

KEV · Ransomware

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Vendor / Project: Zoho
Product: ManageEngine
Date added: Jan 23, 2023
Due date: Feb 13, 2023
Known ransomware use: Known
CWEs: —

Description

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

Required action

Apply updates per vendor instructions.

Notes

https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
https://nvd.nist.gov/vuln/detail/CVE-2022-47966