CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Description
CVE-2022-47966 is a critical unauthenticated remote code execution vulnerability affecting multiple Zoho ManageEngine on-premise products, including ServiceDesk Plus, ADSelfService Plus, Endpoint Central, PAM 360, and over twenty other products. The flaw originates from the use of an outdated version of the Apache Santuario XML Security for Java library (xmlsec 1.4.1), which delegates certain XSLT security protections to the application layer. ManageEngine products failed to implement these protections, enabling attackers to exploit SAML SSO endpoints to execute arbitrary code. With a CVSS v3.1 score of 9.8 and an EPSS score of 94.4% (99.97th percentile), this vulnerability has been massively exploited in the wild. CISA has added CVE-2022-47966 to the Known Exploited Vulnerabilities catalog and confirmed it as a known ransomware attack vector.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine access manager plus | < 4.3; 4.3 |
| zohocorp | manageengine ad360 | < 4.3; 4.3 |
| zohocorp | manageengine adaudit plus | < 7.0; 7.0 |
| zohocorp | manageengine admanager plus | < 7.1; 7.1 |
| zohocorp | manageengine adselfservice plus | < 6.2; 6.2 |
| zohocorp | manageengine analytics plus | < 5.1; 5.1 |
| zohocorp | manageengine assetexplorer | < 6.9; 6.9 |
| zohocorp | manageengine key manager plus | < 6.4; 6.4 |
| zohocorp | manageengine pam360 | < 5.7; 5.7 |
| zohocorp | manageengine password manager pro | < 12.1; 12.1 |
| zohocorp | manageengine servicedesk plus | < 14.0; 14.0 |
| zohocorp | manageengine servicedesk plus msp | < 13.0; 13.0 |
| zohocorp | manageengine supportcenter plus | 11.0 |
| zohocorp | manageengine application control plus | < 10.1.2220.18 |
| zohocorp | manageengine browser security plus | < 11.1.2238.6 |
| zohocorp | manageengine device control plus | < 10.1.2220.18 |
| zohocorp | manageengine endpoint dlp plus | < 10.1.2137.6 |
| zohocorp | manageengine os deployer | < 1.1.2243.1 |
| zohocorp | manageengine patch manager plus | < 10.1.2220.18 |
| zohocorp | manageengine remote access plus | < 10.1.2228.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis(Exploit, Third Party Advisory)
- https://blog.viettelcybersecurity.com/saml-show-stopper/(Exploit, Third Party Advisory)
- https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6(Release Notes)
- https://github.com/horizon3ai/CVE-2022-47966(Third Party Advisory)
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a(Third Party Advisory, US Government Resource)
- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/(Exploit, Third Party Advisory)
- https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2022-47966 is classified under CWE-20 (Improper Input Validation), reflecting the failure of ManageEngine products to properly validate and sanitize SAML response data processed through the Apache Santuario xmlsec library. The underlying issue is that Apache Santuario xmlsec version 1.4.1 supports XSLT transforms in XML signatures by design and relies on the consuming application to restrict dangerous XSLT operations. ManageEngine products did not implement these restrictions, allowing an attacker to submit crafted SAML responses containing malicious XSLT transforms that are executed during signature verification, ultimately leading to remote code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2022-47966 carries a CVSS v3.1 score of 9.8 (Critical severity), representing near-maximum risk across all assessment metrics. Attack Vector (Network): The vulnerability is remotely exploitable over the network through SAML SSO endpoints exposed by ManageEngine products. Attack Complexity (Low): Exploitation requires no special conditions, though the target product must have had SAML SSO configured at some point (for some products, SAML SSO must be currently active). Privileges Required (None): No authentication is needed to exploit the flaw, as the attack targets the SAML authentication flow itself. User Interaction (None): Exploitation is fully automated and requires no action from legitimate users. Scope (Unchanged): The impact is contained within the compromised ManageEngine product instance. Confidentiality Impact (High), Integrity Impact (High), and Availability Impact (High) indicate complete compromise of the affected system, granting the attacker arbitrary code execution with the privileges of the ManageEngine service account. Given that ManageEngine products manage IT infrastructure including Active Directory, privileged access, service desks, and endpoints, compromise of these systems can provide attackers with extensive access to the entire IT environment. The EPSS score of 94.4% (99.97th percentile) confirms extremely high exploitation probability. CISA has confirmed this as a known ransomware attack vector, with multiple threat groups leveraging it to gain initial access to enterprise IT management infrastructure.
Exploit Maturity
Multiple public exploits are available for CVE-2022-47966, including weaponized proof-of-concepts on Packet Storm Security targeting ServiceDesk Plus, ADSelfService Plus, and Endpoint Central MSP. Detailed technical analysis has been published by Horizon3.ai and Rapid7, with additional research by Viettel Cyber Security. A dedicated Horizon3.ai GitHub repository provides exploitation tools. CISA added CVE-2022-47966 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 13, 2023, and issued a joint advisory (AA23-250A) documenting widespread exploitation. CVE-2022-47966 is a confirmed ransomware attack vector, with threat actors targeting ManageEngine products to establish initial access to enterprise environments managing privileged credentials, endpoints, and IT service management. The EPSS score of 94.4% (99.97th percentile) reflects near-certain ongoing exploitation activity.
Remediation
- Upgrade all affected ManageEngine products to their respective patched versions immediately as specified in Zoho's security advisory. The patched versions include Access Manager Plus 4308+, Active Directory 360 4310+, ADAudit Plus 7081+, ADManager Plus 7162+, ADSelfService Plus 6211+, Analytics Plus 5150+, Endpoint Central 10.1.2228.11+, PAM 360 5713+, Password Manager Pro 12124+, ServiceDesk Plus 14004+, and others listed in the advisory. This is required by CISA's KEV catalog directive.
- Determine if SAML SSO has ever been configured on any of your ManageEngine product instances. Exploitation is only possible if SAML SSO has been configured at some point, and for some products, it must be currently active. If SAML SSO is not needed, consider disabling it as an interim mitigation while patching is completed.
- Restrict network access to ManageEngine products by ensuring that SAML SSO endpoints and administrative interfaces are not exposed to the internet. Place ManageEngine applications behind firewalls and VPNs, and limit access to trusted internal networks.
- Monitor for indicators of compromise including unexpected process execution on ManageEngine servers, anomalous SAML authentication activity, unauthorized changes to Active Directory or privileged accounts, and evidence of lateral movement from ManageEngine systems. Review the CISA advisory AA23-250A for specific IOCs and detection guidance.
- Conduct a thorough post-incident assessment if exploitation is suspected, given that ManageEngine products typically have elevated access to Active Directory, privileged credentials, and endpoint management capabilities. Assume that any credentials managed by a compromised ManageEngine instance are compromised and rotate them accordingly.
Technical Details
CVE-2022-47966 is a remote code execution vulnerability caused by the use of Apache Santuario XML Security for Java (xmlsec) version 1.4.1 across multiple Zoho ManageEngine on-premise products. The Apache Santuario xmlsec library version 1.4.1 supports XSLT transforms within XML digital signatures by design, but this version delegates the responsibility of restricting dangerous XSLT operations to the consuming application. ManageEngine products that implement SAML SSO use this library to verify SAML response signatures but did not implement the necessary security restrictions on XSLT processing. An attacker can craft a malicious SAML response containing an XSLT transform within the XML signature that, when processed during signature verification, executes arbitrary Java code on the server. The attack targets the SAML SSO authentication endpoint, meaning no prior authentication is required. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network-based exploitation with complete compromise of the target system. A prerequisite for exploitation is that SAML SSO must have been configured at some point for the target ManageEngine product, and for certain products, SAML SSO must be currently active. Over twenty ManageEngine products are affected, including ServiceDesk Plus (through version 14003), ADSelfService Plus (before 6211), Endpoint Central (before 10.1.2228.11), PAM 360 (before 5713), Password Manager Pro (before 12124), and many others. The breadth of affected products and their roles in managing IT infrastructure — including Active Directory, privileged access, endpoints, and service desks — makes this vulnerability particularly dangerous for enterprise environments.
Frequently Asked Questions
Is CVE-2022-47966 being actively exploited?
Yes, CVE-2022-47966 is under widespread active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 13, 2023, confirmed it as a ransomware attack vector, and issued a joint cybersecurity advisory (AA23-250A) documenting exploitation. Multiple public exploits and detailed technical deep dives are available from Horizon3.ai, Rapid7, and other researchers.
What products are affected by CVE-2022-47966?
Over twenty Zoho ManageEngine on-premise products are affected, including ServiceDesk Plus, ADSelfService Plus, Endpoint Central, PAM 360, Password Manager Pro, ADAudit Plus, ADManager Plus, Access Manager Plus, Analytics Plus, Key Manager Plus, and many others. The full list of affected products and their patched versions is available in Zoho's security advisory. Exploitation requires that SAML SSO has been configured for the target product.
How do I fix CVE-2022-47966?
Upgrade all affected ManageEngine products to their respective patched versions as listed in Zoho's security advisory for CVE-2022-47966. If immediate patching is not possible, disable SAML SSO if it is not operationally required and restrict network access to ManageEngine SAML endpoints. Given the breadth of affected products, conduct a comprehensive inventory of all ManageEngine installations in your environment.
How severe is CVE-2022-47966?
CVE-2022-47966 has a CVSS v3.1 score of 9.8 (Critical severity), enabling unauthenticated remote code execution across over twenty ManageEngine products. The vulnerability is confirmed as a ransomware attack vector and has an EPSS score of 94.4% (99.97th percentile). Its severity is amplified by the privileged roles ManageEngine products play in enterprise IT management, including Active Directory administration, privileged access management, and endpoint control.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.