Zoho flaws being used in attacks

CISA lists 9 flaws in Zoho products as being used in attacks, most recently on 7 Mar 2023. 2 have been used in ransomware.

What to do

1. Update every Zoho product you use.Install the updates Zoho offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 7 Mar 2023
   Zoho ManageEngine
   CVE-2022-28810Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
   Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
2. Being used in attacksUsed in ransomwareAdded by CISA on 23 Jan 2023
   Zoho ManageEngine
   CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
   Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 22 Sep 2022
   Zoho ManageEngine
   CVE-2022-35405Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
   Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 10 Dec 2021
   Zoho Desktop Central
   CVE-2021-44515Zoho Desktop Central Authentication Bypass Vulnerability
   Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 1 Dec 2021
   Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
   CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
   Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 1 Dec 2021
   Zoho ManageEngine ServiceDesk Plus (SDP)
   CVE-2021-37415Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
   Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
7. Being used in attacksUsed in ransomwareAdded by CISA on 3 Nov 2021
   Zoho ManageEngine
   CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
   Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 3 Nov 2021
   Zoho ManageEngine
   CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
   Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
9. Being used in attacksAdded by CISA on 3 Nov 2021
   Zoho ManageEngine
   CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
   Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Zoho on CISA’s site.