← Vulnerability feed

Vulnerability record · CVE-2020-15595 · published 30 September 2020

CVE-2020-15595: Zohocorp manageengine application control plus vulnerability

Zohocorp · Manageengine Application Control Plus

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.

4.3 CVSS 3.1 Medium EPSS 2.2% · top 18.1%
4.3CVSS 3.1 base score, v2 4.0
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15595
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 ExploitThird Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 ExploitThird Party Advisory

Track CVE-2020-15595 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-47966Zoho ManageEngine on-premise products RCE via SAML SSO and xmlsecMultiple Zoho ManageEngine on-premise products use Apache Santuario xmlsec 1.4.1, whose XSLT features by design leave certain security protections to…KEVEPSS 100%analysed5.5CVE-2023-6105Zohocorp manageengine analytics plus information exposure vulnerabilityAn information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged O…EPSS 0.69%4.3CVE-2020-15594Zohocorp manageengine application control plus server-side request forgery (ssrf) vulnerabilityAn SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to p…EPSS 1.8%

Source: NIST National Vulnerability Database (record CVE-2020-15595), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.