CVE-2018-12998: Reflected XSS in Zoho ManageEngine FailOverHelperServlet operation parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw affects multiple widely deployed management consoles, public exploit code is available, and EPSS is extremely high, though it requires user interaction and is not in KEV.

What it is

A reflected cross-site scripting flaw exists in multiple Zoho ManageEngine products (Netflow Analyzer, Network Configuration Manager, OpManager, OpUtils, Firewall Analyzer) before their respective builds. The 'operation' parameter passed to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet is not properly sanitized, allowing injection of arbitrary web script or HTML. Because the affected products are network and firewall management consoles, successful exploitation can compromise an administrative session in a sensitive management plane.

Impact

An attacker can execute arbitrary script in the context of a victim's browser session, potentially stealing session cookies, performing actions as the logged-in administrator, or redirecting the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached remotely over the network via a crafted URL to the FailOverHelperServlet with a malicious 'operation' parameter. No authentication is required to deliver the payload, but the victim must click the link or otherwise load the crafted request (UI:R).

Exploitation

Public exploit references exist (Packet Storm, Full Disclosure, GitHub) and EPSS is very high at 0.99293 (99.9th percentile), though the CVE is not listed in CISA KEV. This suggests active interest and likely exploitation attempts, but no confirmed in-the-wild campaign is documented in this record.

What to do

• Apply the vendor builds that fix the issue: Netflow Analyzer 123137, Network Configuration Manager 123128, OpManager 123148, OpUtils 123161, Firewall Analyzer 123147 or later.
• Restrict network access to the affected ManageEngine web consoles so they are not reachable from untrusted networks.
• Deploy a WAF or input filtering rule to block script payloads in the 'operation' parameter to FailOverHelperServlet.
• Enforce HttpOnly and Secure flags on session cookies to reduce the impact of successful XSS.
• Educate administrators not to click unsolicited links to management console URLs.

Detection

• Search web/proxy logs for requests to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet with suspicious characters (e.g., <, >, script, onerror) in the 'operation' parameter.
• Monitor for outbound connections or referrer patterns from management consoles to unknown external domains, which may indicate script exfiltration.
• Review authentication and session logs for anomalous administrator activity following access to the FailOverHelperServlet endpoint.
• Use IDS/IPS signatures for reflected XSS patterns targeting ManageEngine servlet paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.