CVE-2022-28810: Zoho ManageEngine ADSelfService Plus OS command injection via custom script

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploit code and a very high EPSS score, but exploitation requires administrator or partial authentication and user interaction.

What it is

Zoho ManageEngine ADSelfService Plus before build 6122 lets a remote authenticated administrator run arbitrary OS commands as SYSTEM through the policy custom script feature. A default administrator password and an unsanitized password field also let a partially authenticated remote attacker inject commands, so the flaw is both a command injection and a hard-coded credential issue.

Impact

An attacker who reaches the feature can execute arbitrary operating system commands with SYSTEM privileges on the ADSelfService Plus host. That gives full control of the server and any credentials or directory data it handles.

Attack surface

Reached over the network through the ADSelfService Plus web interface and its policy custom script feature. The primary path requires an authenticated administrator account, and the CVSS vector notes user interaction; the secondary path requires only partial authentication via the unsanitized password field.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-03-07, and EPSS gives a 30-day probability of 0.70966 (99.37th percentile). Multiple references are tagged Exploit, including a Metasploit pull request and a Rapid7 technical writeup, so public exploitation tooling exists.

What to do

• Upgrade ADSelfService Plus to build 6122 or later per the vendor advisory.
• Change the default administrator password immediately and enforce strong unique credentials.
• Restrict network access to the ADSelfService Plus admin interface to trusted management networks.
• Review and remove unnecessary policy custom scripts, and validate any password input used in scripts.
• Monitor and audit administrator account creation and login activity for unauthorized access.

Detection

• Alert on unexpected child processes spawned by the ADSelfService Plus service or its web process, especially cmd.exe, powershell.exe or /bin/sh.
• Monitor policy custom script creation or modification events in ADSelfService Plus logs.
• Hunt for command injection patterns in requests to the custom script or password fields.
• Review authentication logs for logins using default or weak administrator credentials.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.