CVE-2022-29535: Zoho ManageEngine OPManager SQL injection in default reports

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and near-maximum EPSS makes this an urgent patch target despite no KEV listing.

What it is

Zoho ManageEngine OPManager through build 125588 contains a SQL injection flaw reachable through a few default reports. Because the vulnerable path is network-facing and requires no credentials, an unauthenticated attacker can inject SQL into backend queries. The vendor has published a patch advisory for this CVE.

Impact

An attacker can read, modify, or delete data in the OPManager database and potentially execute database-level operations, which can lead to full compromise of the application and its stored monitoring data.

Attack surface

Reached over the network via the OPManager web interface, specifically the default reports functionality. The CVSS vector indicates no privileges and no user interaction are required, so the injection is unauthenticated.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.918 probability, 99.8th percentile), indicating strong likelihood of attempted exploitation. The vendor advisory is tagged as a patch reference, not an exploit reference.

What to do

• Apply the vendor patch from the ManageEngine security update page for CVE-2022-29535 and upgrade past build 125588.
• If patching cannot be done immediately, restrict network access to the OPManager web interface to trusted management networks only.
• Disable or remove unused default reports until the patch is applied.
• Run OPManager with a least-privilege database account to limit what injected SQL can reach.
• Monitor vendor advisories for follow-up updates if the initial patch does not fully cover the reports path.

Detection

• Review OPManager web logs for requests to report endpoints containing SQL metacharacters such as quotes, UNION, or comment sequences.
• Enable and monitor database query logging for anomalous or malformed queries originating from the OPManager application account.
• Alert on unexpected changes to OPManager database contents or configuration following report access.
• Correlate OPManager access logs with source IPs outside expected administrative ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.