Vendor
Zoho
As of , 9 Zoho vulnerabilities are on CISA's list of exploited vulnerabilities, 2 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2020-10189.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2020-10189Desktop Central File Upload | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| 2 | CVE-2022-28810ADSelfService Plus Remote Code Execution | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.71 | 0.71 | ||
| 3 | CVE-2022-47966Multiple Products Remote Code Execution | Zoho ManageEngine | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 4 | CVE-2022-35405Multiple Products Remote Code Execution | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 5 | CVE-2021-44077ManageEngine ServiceDesk Plus Remote Code Execution | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| 6 | CVE-2019-8394ServiceDesk Plus (SDP) File Upload | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.63 | 0.63 | ||
| 7 | CVE-2021-40539ADSelfService Plus Authentication Bypass | Zoho ManageEngine | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 8 | CVE-2021-44515Authentication Bypass | Zoho Desktop Central | Patch this weekEPSS 0.99 | 0.99 | ||
| 9 | CVE-2021-37415ManageEngine ServiceDesk Authentication Bypass | Zoho ManageEngine ServiceDesk Plus (SDP) | Patch this weekEPSS 0.99 | 0.99 |
Products
- ManageEngine6 entries
- Desktop Central1 entry
- ManageEngine ServiceDesk Plus (SDP)1 entry
- ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus1 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 6 |
| 2022 | 1 |
| 2023 | 2 |
| 2024 | none |
| 2025 | none |
| 2026 | none |