CVE-2020-28653: Zoho ManageEngine OpManager RCE via Smart Update Manager servlet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, a public exploit reference, and very high EPSS probability make this an urgent patch target.

What it is

Zoho ManageEngine OpManager builds before 125203 (Stable) and before 125233 (Released) allow remote code execution through the Smart Update Manager (SUM) servlet. The flaw is reachable over the network without credentials, and a public exploit reference exists, making it a serious risk for internet-exposed or broadly reachable OpManager deployments.

Impact

An unauthenticated attacker can execute arbitrary code on the OpManager server, gaining full control of the host and any data or credentials it holds. Given the CVSS vector (C:H/I:H/A:H), confidentiality, integrity and availability are all fully compromised.

Attack surface

Reached over the network via the Smart Update Manager servlet; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. Any host that can reach the OpManager web interface can attempt the attack.

Exploitation

Not listed in CISA KEV, but EPSS is 0.787 (99.6th percentile) and a public Packet Storm exploit reference tagged 'Exploit' exists, indicating active interest and available exploit code.

What to do

• Upgrade OpManager to build 125203 (Stable) or 125233 (Released) or later as documented in the vendor release notes.
• Restrict network access to the OpManager web interface and the Smart Update Manager servlet to trusted management networks only.
• Place OpManager behind a reverse proxy or firewall rules that block untrusted inbound access to its management ports.
• If immediate patching is not possible, isolate the OpManager host and monitor it closely for signs of compromise.
• Audit the OpManager host for unauthorized changes, new accounts or unexpected outbound connections after exposure.

Detection

• Monitor web server and OpManager logs for requests to the Smart Update Manager (SUM) servlet, especially POSTs with serialized Java payloads.
• Alert on unexpected child processes spawned by the OpManager service (e.g., cmd.exe, powershell, /bin/sh) as these may indicate post-exploitation.
• Watch for anomalous outbound network connections from the OpManager host to unfamiliar external addresses.
• Review file system changes in OpManager installation and web directories for dropped webshells or modified servlet files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.