MO
Product
ManageEngine OpManager
67
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 18High 29Medium 11Low 0
Watch
Add ManageEngine OpManager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-75825 | 8.8 | Sep 23 | Authentication Bypass vulnerability Affected: before 12.8.711 |
| CVE-2026-76978 | 8.8 | Sep 23 | Command Injection vulnerability Affected: before 12.8.710 |
| CVE-2026-14913 | 8.8 | Sep 23 | SQL Injection vulnerability Affected: before 12.8.670 |
| CVE-2024-5466 | 8.8 | Aug 23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option Affected: through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 |
| CVE-2023-31099 | 8.8 | May 4 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers Affected: before 12.6; 12.6; 12.6; 12.6; 12.6; 12.6; +34 more |
| CVE-2022-38772 | 8.8 | Aug 29 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2022-37024 | 8.8 | Aug 9 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003,… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +12 more |
| CVE-2022-27908 | 8.8 | Apr 18 | Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2023-47211 | 8.6 | Jan 8 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258 Affected: before 12.7; 12.7; 12.7; 12.7; 12.7; 12.7; +34 more |
| CVE-2022-35404 | 8.2 | Jul 18 | ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more |
| CVE-2026-84787 | 8.1 | Sep 23 | Privilege Escalation vulnerability Affected: before 12.8.711 |
| CVE-2019-17421 | 7.8 | Nov 21 | Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to… Affected: 12.4 |
| CVE-2019-12133 | 7.8 | Jun 18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 12.3 |
| CVE-2026-76979 | 7.7 | Sep 23 | XML Injection vulnerability Affected: before 12.8.710 |
| CVE-2026-12370 | 7.6 | Sep 23 | Remote Code Execution Vulnerability Affected: before 12.8.668 |
| CVE-2026-15358 | 7.5 | Sep 23 | Path Traversal Vulnerability Affected: before 12.8.671 |
| CVE-2022-36923 | 7.5 | Aug 10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28… Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +12 more |
| CVE-2020-13818 | 7.5 | Jun 4 | In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed Affected: before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +20 more |
| CVE-2020-12116 | 7.5 | May 7 | Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a… Affected: through 12.3; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more |
| CVE-2020-11946 | 7.5 | Apr 20 | Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call Affected: 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +8 more |
| CVE-2020-11527 | 7.5 | Apr 4 | In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files Affected: before 12.4; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more |
| CVE-2014-7863 | 7.5 | Feb 8 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and… Affected: 8 through 11.5 |
| CVE-2017-11559 | 7.5 | May 23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2 Affected: 12.2 |
| CVE-2018-18980 | 7.5 | Nov 6 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a… Affected: before 12.3.214 |
| CVE-2018-17283 | 7.5 | Sep 21 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request… Affected: before 12.3 |
| CVE-2018-12997 | 7.5 | Jun 29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before… Affected: All versions, or not specified |
| CVE-2026-76980 | 7.4 | Sep 23 | Data Exposure vulnerability Affected: before 12.8.710 |
| CVE-2026-84789 | 7.1 | Sep 23 | Broken Access Control vulnerability Affected: before 12.8.711 |
| CVE-2026-84791 | 7.1 | Sep 23 | Broken Access Control vulnerability Affected: before 12.8.711 |
Showing 29