CVE-2022-47966

Confirmed PUBLISHED

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario...

Zoho · ManageEngine

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 99.8%

At a Glance

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

apache nuclei_scanner cisa malware java metasploit ransomware

CVE Published: Jan 18, 2023
Exploitation Reported: Jan 23, 2023
CVSS: 9.8 Critical
EPSS: 99.8%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

GitHub — apache/santuario-xml-security-java github.com · CVE Record https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6
manageengine.com/security/advisory/CVE/cve-2022-47966.html manageengine.com · CVE Record https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-P... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-Service...
packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfServic...
packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Cent... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoin...

Show 5 more references

blog.viettelcybersecurity.com/saml-show-stopper blog.viettelcybersecurity.com · CVE Record https://blog.viettelcybersecurity.com/saml-show-stopper/
GitHub — horizon3ai/CVE-2022-47966 github.com · CVE Record https://github.com/horizon3ai/CVE-2022-47966
horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive horizon3.ai · CVE Record https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
cisa.gov/news-events/cybersecurity-advisories/aa23-250a cisa.gov · CVE Record https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-anal... attackerkb.com · CVE Record https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-01-23 00:00 UTC
The Shadowserver	2026-06-08 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47966.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb	Apr 29, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2023-01-23 00:00:00 UTC · CISA

Used in malware

Recorded 2023-01-23 00:00:00 UTC · CISA

Proof of concept available

Recorded 2023-01-17 21:26:28 UTC · GitHub

Weaknesses (CWE)

CWE-20

Improper Input Validation

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb	Apr 29, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47966.yaml	Apr 25, 2025

Recent Mentions

CVE-2025-32756: Zero-Day Vulnerability in Multiple Fortinet Products Exploited in the Wild

Tenable Blog · May 14, 2025

Fortinet has observed threat actors exploiting CVE-2025-32756, a critical zero-day arbitrary code execution vulnerability which affects multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera.BackgroundOn May 13th, Fortinet published a security advisory (FG-IR-25-254) for CVE-2025-32756, a critical arbitrary code execution vulnerability affecting multiple Fortinet products.CVEDescriptionCVSSv3CVE-2025-32756An arbitrary code execution vulnerability in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera9.6AnalysisCVE-2025-32756 is an arbitrary code execution vulnerability affecting multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attacker can send crafted HTTP requests in order to create a stack-based overflow condition which would allow for the execution of arbitrary code. This vulnerability was discovered by the Fortinet Product Security Team who observed threat activity involving a device running FortiVoice.According to Fortinet, the threat actors operations included scanning the network, erasing system crashlogs and enabling ‘fcgi debugging’ which is used to log authentication attempts, including SSH logins. The ‘fcgi debugging’ option is not enabled by default and the Fortinet advisory recommends reviewing the setting as one possible indicator of compromise (IoC).Historical Exploitation of Fortinet DevicesFortinet vulnerabilities have historically been common targets for cyber attackers, and CVE-2025-32756 is the eighteenth Fortinet vulnerability to be added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list.CVEDescriptionPatchedTenable BlogCVE-2024-55591Fortinet Authentication Bypass in FortiOS and FortiProxyJanuary 2025CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the WildCVE-2024-21762Fortinet FortiOS Out-of-bound Write Vulnerability...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

vonahisec/CVE-2022-47966-Scan

github · Created 2023-01-23 15:49:10 UTC · 27 stars

Python scanner for CVE-2022-47966. Supports ~10 of the 24 affected products.

ACE-Responder/CVE-2022-47966_checker

github · Created 2023-01-23 11:33:29 UTC · 2 stars

Run on your ManageEngine server

Inplex-sys/CVE-2022-47966

github · Created 2023-01-23 10:45:23 UTC · 7 stars

The manage engine mass loader for CVE-2022-47966

horizon3ai/CVE-2022-47966

github · Created 2023-01-17 21:26:28 UTC · 126 stars

POC for CVE-2022-47966 affecting multiple ManageEngine products

ManageEngine - Remote Command Execution

nuclei · Created Unknown

manageengine_endpoint_central_saml_rce_cve_2022_47966

metasploit · Created Unknown

Metasploit module for CVE-2022-47966

manageengine_servicedesk_plus_saml_rce_cve_2022_47966

metasploit · Created Unknown

Metasploit module for CVE-2022-47966

manageengine_adselfservice_plus_saml_rce_cve_2022_47966

metasploit · Created Unknown

Metasploit module for CVE-2022-47966

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jun 2026 00:00 UTC about 1 month ago

8 Jun 2026 00:00 UTC · about 1 month ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
29 Apr 2025 10:59 UTC about 1 year ago

29 Apr 2025 10:59 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
23 Jan 2023 00:00 UTC over 3 years ago

23 Jan 2023 00:00 UTC · over 3 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
23 Jan 2023 00:00 UTC over 3 years ago

23 Jan 2023 00:00 UTC · over 3 years ago

First public exploitation report

Exploit observed in malware
18 Jan 2023 00:00 UTC over 3 years ago

18 Jan 2023 00:00 UTC · over 3 years ago

CVE published

Vulnerability disclosed publicly
17 Jan 2023 21:26 UTC over 3 years ago

17 Jan 2023 21:26 UTC · over 3 years ago

Public PoC available

Public proof-of-concept code published
26 Dec 2022 00:00 UTC over 3 years ago

26 Dec 2022 00:00 UTC · over 3 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2022-47966

{
  "cve_id": "CVE-2022-47966",
  "title": "Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus thro...",
  "affected_vendor": "Zoho",
  "affected_product": "ManageEngine",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99753,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2022-47966

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API