ManageEngine Applications Manager vulnerabilities | LiveThreat CVE Feed

Product

ManageEngine Applications Manager

by Zohocorp · last CVE Sep 23, 2026

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities62 In the news0 Timeline

Severity mix

Critical 20High 23Medium 19Low 0

Severity

All severities62 Critical20 High23 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add ManageEngine Applications Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86708	10.0	3%	Sep 23	Sensitive data exposure Affected: before 182300
CVE-2020-24743	9.8	3%	Nov 3	An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter Affected: before 14.5; 14.5; 14.5; 14.5; 14.5; 14.5; +1 more
CVE-2020-27995	9.8	9%	Oct 29	SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more
CVE-2020-15533	9.8	4%	Oct 1	In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection… Affected: before 14.6; 14.6; 14.6; 14.6; 14.6; 14.6; +7 more
CVE-2020-15394	9.8	8%	Sep 25	The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution Affected: before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more
CVE-2019-19649	9.8	10%	Dec 11	Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet… Affected: before 13.7
CVE-2019-11469	9.8	17%	Apr 23	Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection Affected: 12.0 through 14.0
CVE-2019-11448	9.8	12%	Apr 22	An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0 Affected: 11.0 through 14.0
CVE-2018-15168	9.8	4%	Aug 8	A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames… Affected: before 13.13820
CVE-2016-9498	9.8	21%	Jul 13	ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects Affected: 12.0; 13.0
CVE-2018-13050	9.8	40%	Jul 2	A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request Affected: 13.0
CVE-2018-7890	9.8	79%	Mar 8	A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640) Affected: before 13.6
CVE-2017-16851	9.8	17%	Nov 16	Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter Affected: 13.0
CVE-2017-16850	9.8	17%	Nov 16	Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action Affected: 13.0
CVE-2017-16849	9.8	17%	Nov 16	Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter Affected: 13.0
CVE-2017-16848	9.8	15%	Nov 16	Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter Affected: 13.0
CVE-2017-16847	9.8	17%	Nov 16	Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action Affected: 13.0
CVE-2017-16846	9.8	17%	Nov 16	Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter Affected: 13.0
CVE-2017-16543	9.8	6%	Nov 5	Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter Affected: 13.0
CVE-2018-11808	9.1	6%	Jun 6	Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain… Affected: 13
CVE-2026-86678	8.8	2%	Sep 23	Broken Authentication vulnerability Affected: before 182100
CVE-2026-86677	8.8	5%	Sep 23	Broken Authentication vulnerability Affected: before 182100
CVE-2020-28679	8.8	3%	Jan 10	A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.1; +34 more
CVE-2020-35765	8.8	27%	Feb 5	doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter… Affected: before 14.9; 14.9; 14.9; 14.9; 14.9; 14.9
CVE-2020-27733	8.8	9%	Jan 19	Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more
CVE-2020-16267	8.8	41%	Oct 6	Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +1 more
CVE-2020-15927	8.8	41%	Oct 6	Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +1 more
CVE-2019-19475	8.8	3%	Jan 10	An issue was discovered in ManageEngine Applications Manager 14 with Build 14360 Affected: 14.3
CVE-2019-19650	8.8	6%	Dec 11	Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function Affected: before 13.7
CVE-2019-15105	8.8	8%	Aug 16	An issue was discovered in Zoho ManageEngine Application Manager through 14.2 Affected: 12.0 through 14.2
CVE-2019-15104	8.8	8%	Aug 16	An issue was discovered in Zoho ManageEngine OpManager through 12.4x Affected: 12.0 through 14.0
CVE-2017-11740	8.8	3%	May 23	In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm Affected: 13.1
CVE-2016-9489	8.8	2%	Jul 13	In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e Affected: 12.0; 13.0
CVE-2017-16542	8.8	5%	Nov 5	Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request Affected: 13.0
CVE-2026-86683	8.1	2%	Sep 23	Broken Authentication Vulnerability Affected: before 182100
CVE-2017-11738	8.1	4%	May 23	In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection… Affected: 13.1
CVE-2018-16364	8.1	18%	Sep 26	A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share Affected: 13.7; 13.7; 13.7; 13.7; 13.7; 13.7; +4 more
CVE-2026-86681	7.6	1%	Sep 23	Broken Access Control vulnerability Affected: before 182300
CVE-2020-10816	7.5	5%	Oct 8	Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet Affected: 14.7; 14.7; 14.7; 14.7; 14.7; 14.7; +4 more
CVE-2014-7863	7.5	83%	Feb 8	The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and… Affected: through 11.9
CVE-2022-23050	7.2	5%	May 24	ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload… Affected: 15.0 before 15.5; 15.5; 15.5; 15.5
CVE-2020-14008	7.2	40%	Sep 4	Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution Affected: through 13.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more
CVE-2026-86679	7.1	2%	Sep 23	Broken Access Control vulnerability Affected: before 182100
CVE-2025-6239	6.5	1%	Oct 21	Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor Affected: before 17.6; 17.6; 17.6; 17.6; 17.6; 17.6; +3 more
CVE-2024-41140	6.5	1%	Jan 29	Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function Affected: before 17.0; 17.1 before 17.3; 17.0; 17.0; 17.0; 17.0; +12 more
CVE-2023-28340	6.5	3%	Apr 11	Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack Affected: before 16.3; 16.3; 16.3; 16.3
CVE-2021-35512	6.5	2%	Oct 21	An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200 Affected: 15.2
CVE-2025-9787	6.1	1%	Dec 18	Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view Affected: 17.4 before 17.7; 17.3; 17.3; 17.3; 17.3; 17.3; +10 more
CVE-2023-38333	6.1	2%	Aug 10	Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in Affected: before 16.5; 16.5; 16.5; 16.5; 16.5; 16.5; +1 more
CVE-2023-29442	6.1	9%	Apr 26	Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS Affected: before 16.3; 16.3; 16.3; 16.3; 16.3; 16.3; +6 more