Zoho vulnerabilities in CISA KEV
Zoho has 9 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 31st highest of any vendor. none were added in the last 12 months; 2 are linked to known ransomware use (22.2% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is ManageEngine, with 6 entries. Other frequently affected products: Desktop Central (1); ManageEngine ServiceDesk Plus (SDP) (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor zoho --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
9
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2023-03-07
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
2 of 9
22.2% linked to ransomware
┌─ distinct products
4
affected products
$ awk -F, {print $1} /var/log/kev/zoho.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 6 | 1 |
| 2022 | 1 | 0 |
| 2023 | 2 | 1 |
$ sort /var/log/kev/zoho.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- ManageEngine 6 entries
- Desktop Central 1 entry
- ManageEngine ServiceDesk Plus (SDP) 1 entry
- ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus 1 entry
$ kev-due-dates --vendor zoho
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Zoho
21 days (range 14 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/zoho.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (7 of 9 have at least one CWE).
$ grep -ril 'Zoho' /var/log/news | head -5
Our reporting that names Zoho or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./zoho.kev · 9 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2022-28810
ManageEngine
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
due 2023-03-28 · CWE-78 CWE-259
$ cat CVE-2022-28810.txt
Description. Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Required action. Apply updates per vendor instructions.
- CVE-2022-47966
ManageEngine [RANSOMWARE]
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
due 2023-02-13
$ cat CVE-2022-47966.txt
Description. Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Required action. Apply updates per vendor instructions.
- CVE-2022-35405
ManageEngine
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
due 2022-10-13 · CWE-502
$ cat CVE-2022-35405.txt
Description. Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-44515
Desktop Central
Zoho Desktop Central Authentication Bypass Vulnerability
due 2021-12-24
$ cat CVE-2021-44515.txt
Description. Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Required action. Apply updates per vendor instructions.
- CVE-2021-37415
ManageEngine ServiceDesk Plus (SDP)
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
due 2021-12-15 · CWE-306
$ cat CVE-2021-37415.txt
Description. Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
Required action. Apply updates per vendor instructions.
- CVE-2021-44077
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
due 2021-12-15 · CWE-306
$ cat CVE-2021-44077.txt
Description. Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Required action. Apply updates per vendor instructions.
- CVE-2019-8394
ManageEngine
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
due 2022-05-03 · CWE-434
$ cat CVE-2019-8394.txt
Description. Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Required action. Apply updates per vendor instructions.
- CVE-2020-10189
ManageEngine
Zoho ManageEngine Desktop Central File Upload Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2020-10189.txt
Description. Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-40539
ManageEngine [RANSOMWARE]
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
due 2021-11-17 · CWE-55
$ cat CVE-2021-40539.txt
Description. Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
Required action. Apply updates per vendor instructions.