VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 06:46 UTC
← Dashboard

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib…

Read full description
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 99.75%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

SentinelOne
Press · 14 May 2024, 07:00 · Critical CVE-2022-47966: Zoho ManageEngine Vulnerability - SentinelOne
uscybercom (.mil)
Press · 07 Sep 2023, 07:00 · CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts - uscybercom (.mil)
Microsoft
Press · 18 Apr 2023, 07:00 · Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets - Microsoft
The Hacker News
Press · 23 Feb 2023, 08:00 · Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products - The Hacker News
Bitdefender
Press · 23 Feb 2023, 08:00 · Weaponizing POCs – a Targeted Attack Using CVE-2022-47966 - Bitdefender
See all 10 source documents
SOC Prime
Press · 23 Jan 2023, 08:00 · Detect CVE-2022-47966 Exploits: Critical Zoho ManageEngine RCE Vulnerability Under Active Exploitation - SOC Prime
BleepingComputer
Press · 20 Jan 2023, 08:00 · Critical ManageEngine RCE bug now exploited to open reverse shells - BleepingComputer
SecurityWeek
Press · 20 Jan 2023, 08:00 · In-the-Wild Exploitation of Recent ManageEngine Vulnerability Commences - SecurityWeek
Rapid7
Press · 19 Jan 2023, 08:00 · CVE-2022-47966: Rapid7 Observed Exploitation of Critical ManageEngine Vulnerability - Rapid7
Help Net Security
Press · 17 Jan 2023, 08:00 · PoC for critical ManageEngine bug to be released, so get patching! (CVE-2022-47966) - Help Net Security

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
horizon3ai/CVE-2022-4796613029Python19 Jan 2023, 13:10
shameem-testing/PoC-for-ME-SAML-Vulnerability01—19 Jan 2023, 12:29
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 99.8%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:46.158948+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
17 Jan 2023, 08:00
Published
18 Jan 2023, 00:00
Added to the CISA KEV catalog
23 Jan 2023, 00:00
Latest press mention
14 May 2024, 07:00
Score calculated
05 Nov 2026, 13:58
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar