January 23, 2023 · Applied Cybernetics Group
CVE-2022-47966 — Zoho ManageEngine
known ransomware use
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
- Added to KEV
2023-01-23- Federal due date
2023-02-13- Vendor
- Zoho
- Product
- ManageEngine
- EPSS
- 100.0th percentile (score 0.944, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2022-47966
CISA short description
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Required action
Apply updates per vendor instructions.