Vulnerability record · CVE-2021-40493 · published 13 October 2021
CVE-2021-40493: Zoho ManageEngine OpManager SQL injection in diagnostics API
Zohocorp · Manageengine Opmanager
Zoho ManageEngine OpManager before build 125437 contains a SQL injection in the support diagnostics module, reached through the pollingObject parameter of the getDataCollectionFailureReason API. Because the flaw is remotely reachable without authentication, it exposes the backend database to direct manipulation.
Description
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this a top-priority patch despite no KEV listing.
What it is
Zoho ManageEngine OpManager before build 125437 contains a SQL injection in the support diagnostics module, reached through the pollingObject parameter of the getDataCollectionFailureReason API. Because the flaw is remotely reachable without authentication, it exposes the backend database to direct manipulation.
Impact
An unauthenticated attacker can read, modify, or destroy data in the OpManager database and potentially execute database-level commands, which can lead to full compromise of the application and its stored monitoring data.
Attack surface
The flaw is network-reachable via the getDataCollectionFailureReason API endpoint, with the pollingObject parameter as the injection point. The CVSS vector shows no privileges and no user interaction required, so any host that can reach the OpManager interface can attempt it.
Exploitation
No CISA KEV listing and no ransomware associations are recorded, but EPSS is 0.50209 (98.9th percentile), indicating a high likelihood of attempted exploitation. The only references are vendor advisories, so no public exploit code is confirmed in this record.
What to do
- Upgrade OpManager to build 125437 or later as the primary fix.
- If immediate upgrade is not possible, restrict network access to the OpManager web interface and API to trusted management networks.
- Validate and sanitize the pollingObject parameter at the application layer and reject unexpected input.
- Run OpManager with a least-privilege database account to limit the impact of a successful injection.
- Monitor vendor advisories for any follow-up patches or workarounds.
Detection
- Inspect web and API logs for requests to getDataCollectionFailureReason with suspicious characters such as quotes, UNION, or comment sequences in pollingObject.
- Alert on database errors or unusual query patterns originating from the OpManager application server.
- Baseline normal pollingObject values and flag deviations or unusually long parameter values.
- Review database audit logs for unexpected reads or writes from the OpManager service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.html | Vendor Advisory |
| https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.html | Vendor Advisory |
Track CVE-2021-40493 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-40493), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
