CVE-2022-28219: Zoho ManageEngine ADAudit Plus unauthenticated XXE leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable XXE leading to remote code execution with a CVSS score of 9.8 and very high EPSS probability.

What it is

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XML external entity (XXE) attack that leads to remote code execution. Because the flaw is reachable without credentials and yields full code execution, it is a severe risk for any internet-exposed or network-reachable ADAudit Plus instance.

Impact

An unauthenticated attacker can execute arbitrary code on the ADAudit Plus server, gaining full control of the host and any data or credentials it processes.

Attack surface

Reachable over the network via the Cewolf XML handling component, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.97193 probability, 99.891 percentile) and public exploit write-ups exist in the references, indicating active interest and likely weaponization.

What to do

• Upgrade Zoho ManageEngine ADAudit Plus to version 7060 or later, per the vendor patch advisory.
• If immediate patching is not possible, restrict network access to the ADAudit Plus web interface to trusted management networks only.
• Disable or block external entity resolution in the underlying XML parser where configuration allows.
• Monitor vendor advisories and apply any follow-up hotfixes for the Cewolf component.

Detection

• Inspect web and application logs for XML requests containing DOCTYPE or ENTITY declarations targeting ADAudit Plus endpoints.
• Alert on unexpected outbound connections or file reads from the ADAudit Plus server process.
• Monitor for child processes spawned by the ADAudit Plus service that are not part of normal operation.
• Review network traffic to the ADAudit Plus interface from untrusted or external sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.