MO
Product
ManageEngine OpManager
67
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 18High 29Medium 11Low 0
Watch
Add ManageEngine OpManager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19599 | 9.9 | Sep 23 | Remote Code Execution vulnerability Affected: before 12.8.711 |
| CVE-2022-29535 | 9.8 | May 5 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2021-44514 | 9.8 | Dec 9 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2021-41075 | 9.8 | Oct 13 | The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2021-40493 | 9.8 | Oct 13 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2021-41288 | 9.8 | Sep 30 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API Affected: through 12.4; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2021-3287 | 9.8 | Apr 22 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2020-28653 | 9.8 | Feb 3 | Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2020-10541 | 9.8 | Mar 13 | Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request Affected: before 12.4.179 |
| CVE-2019-17602 | 9.8 | Oct 15 | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089 Affected: before 12.4; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more |
| CVE-2019-15106 | 9.8 | Aug 16 | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310 Affected: through 12.4.034 |
| CVE-2018-20338 | 9.8 | Dec 21 | Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2018-20173 | 9.8 | Dec 17 | Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2018-18949 | 9.8 | Nov 5 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings Affected: 11.4; 11.5; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2018-18475 | 9.8 | Oct 23 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2018-17243 | 9.8 | Sep 20 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection Affected: before 12.3 |
| CVE-2015-9107 | 9.8 | Aug 4 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices Affected: 11.0; 11.1; 11.2; 11.3; 11.4; 11.5; +2 more |
| CVE-2021-20078 | 9.1 | Apr 1 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2026-75825 | 8.8 | Sep 23 | Authentication Bypass vulnerability Affected: before 12.8.711 |
| CVE-2026-76978 | 8.8 | Sep 23 | Command Injection vulnerability Affected: before 12.8.710 |
| CVE-2026-14913 | 8.8 | Sep 23 | SQL Injection vulnerability Affected: before 12.8.670 |
| CVE-2024-5466 | 8.8 | Aug 23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option Affected: through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 |
| CVE-2023-31099 | 8.8 | May 4 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers Affected: before 12.6; 12.6; 12.6; 12.6; 12.6; 12.6; +34 more |
| CVE-2022-38772 | 8.8 | Aug 29 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2022-37024 | 8.8 | Aug 9 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003,… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +12 more |
| CVE-2022-27908 | 8.8 | Apr 18 | Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2023-47211 | 8.6 | Jan 8 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258 Affected: before 12.7; 12.7; 12.7; 12.7; 12.7; 12.7; +34 more |
| CVE-2022-35404 | 8.2 | Jul 18 | ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2026-84787 | 8.1 | Sep 23 | Privilege Escalation vulnerability Affected: before 12.8.711 |
| CVE-2019-17421 | 7.8 | Nov 21 | Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to… Affected: 12.4 |
| CVE-2019-12133 | 7.8 | Jun 18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 12.3 |
| CVE-2026-76979 | 7.7 | Sep 23 | XML Injection vulnerability Affected: before 12.8.710 |
| CVE-2026-12370 | 7.6 | Sep 23 | Remote Code Execution Vulnerability Affected: before 12.8.668 |
| CVE-2026-15358 | 7.5 | Sep 23 | Path Traversal Vulnerability Affected: before 12.8.671 |
| CVE-2022-36923 | 7.5 | Aug 10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +12 more |
| CVE-2020-13818 | 7.5 | Jun 4 | In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +20 more |
| CVE-2020-12116 | 7.5 | May 7 | Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a… Affected: through 12.3; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more |
| CVE-2020-11946 | 7.5 | Apr 20 | Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +8 more |
| CVE-2020-11527 | 7.5 | Apr 4 | In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files Affected: before 12.4; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more |
| CVE-2014-7863 | 7.5 | Feb 8 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and… Affected: 8 through 11.5 |
| CVE-2017-11559 | 7.5 | May 23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2 Affected: 12.2 |
| CVE-2018-18980 | 7.5 | Nov 6 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a… Affected: before 12.3.214 |
| CVE-2018-17283 | 7.5 | Sep 21 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request… Affected: before 12.3 |
| CVE-2018-12997 | 7.5 | Jun 29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before… Affected: All versions, or not specified |
| CVE-2026-76980 | 7.4 | Sep 23 | Data Exposure vulnerability Affected: before 12.8.710 |
| CVE-2026-84789 | 7.1 | Sep 23 | Broken Access Control vulnerability Affected: before 12.8.711 |
| CVE-2026-84791 | 7.1 | Sep 23 | Broken Access Control vulnerability Affected: before 12.8.711 |
| CVE-2017-11561 | 6.5 | May 23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2 Affected: 12.2 |
| CVE-2018-20339 | 6.1 | Dec 21 | Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section Affected: 12.3; 12.3; 12.3; 12.3; 12.3; 12.3; +34 more |
| CVE-2018-19921 | 6.1 | Dec 6 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller Affected: 11.4; 11.5; 12.3; 12.3; 12.3; 12.3; +34 more |