CVE-2022-47966 on CISA KEV
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib
CISA KEV — Actively Exploited
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Vendor / Product
— / Zoho / ManageEngine
CVSS / EPSS
— — · EPSS 94.38%
01What CISA says about this vulnerability
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects…
02Required action — verbatim from CISA
Apply updates per vendor instructions.
03Notes & references
- github.com — https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6
- www.manageengine.com — https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
- packetstormsecurity.com — http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-1…
- packetstormsecurity.com — http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unau…
- packetstormsecurity.com — http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-M…
- blog.viettelcybersecurity.com — https://blog.viettelcybersecurity.com/saml-show-stopper/
- github.com — https://github.com/horizon3ai/CVE-2022-47966
- www.horizon3.ai — https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
- www.cisa.gov — https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
- attackerkb.com — https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis
04SARA's analyst layer — why this matters
This vulnerability is currently on the CISA KEV list, which CISA only adds CVEs to when there is reliable evidence of active exploitation in the wild. For federal civilian agencies, BOD 22-01 requires remediation by the due date above. For everyone else, KEV is the strongest "patch immediately" signal you can get from public threat intel.
05Affected products (summary)
| Vendor | Product | Versions |
|---|
| n | a / n/a | n/a |
06Detection
Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection:
Open in Sigma generator →