CVE-2014-7863: ManageEngine FailOverHelperServlet missing access control allows file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network file disclosure with public exploit code and very high EPSS, though not in KEV and limited to confidentiality impact.

What it is

The FailOverHelperServlet in ZOHO ManageEngine Applications Manager, OpManager and IT360 does not properly restrict access, letting attackers invoke copyfile and listdirectory operations. This exposes arbitrary files and directory listings, which matters because these products hold infrastructure and credential data. The record lists affected builds but no fix version beyond the stated 'before' thresholds.

Impact

An attacker can read arbitrary files from the server and enumerate directories, exposing configuration, credential and other sensitive data. No integrity or availability impact is described.

Attack surface

Reachable over the network via HTTP requests to servlet/FailOverHelperServlet with fileName or listdirectory parameters. The CVSS vector shows no privileges and no user interaction required, though the description also notes remote authenticated users can abuse it.

Exploitation

Public exploit code exists per multiple reference tags (Exploit, Packetstorm, Full Disclosure, vendor advisory), and EPSS is 0.834 (99.7th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade to fixed builds: Applications Manager 11.9 build 11912 or later, OpManager above 11.5 build 11400, and a patched IT360 release.
• Restrict network access to servlet/FailOverHelperServlet and the management interfaces to trusted hosts only.
• Require authentication and apply least privilege to any accounts that can reach the servlet.
• Monitor vendor advisory for updated fixed versions if the listed builds are not available.

Detection

• Search web logs for requests to servlet/FailOverHelperServlet, especially with copyfile, listdirectory or fileName parameters.
• Alert on directory listing or file read responses from that servlet path.
• Baseline and review outbound or unusual file access from ManageEngine hosts.
• Correlate servlet access with subsequent credential or configuration file reads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.