CVE-2022-37024: Zoho ManageEngine ITOM products allow authenticated database changes leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (0.79) make this a serious post-authentication RCE, though it is not in KEV and requires valid credentials.

What it is

Multiple Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, OpUtils, Firewall Analyzer) before 2022-07-29/30 allow an authenticated user to make database changes that result in remote code execution. The flaw is a post-authentication code execution issue in widely deployed IT operations management software, so any low-privileged account becomes a path to full host compromise. The record does not specify the exact vulnerable component or the database operation involved.

Impact

An authenticated attacker gains remote code execution on the server hosting the affected ManageEngine product, with high impact to confidentiality, integrity and availability. This can lead to full control of the management host and any data or downstream systems it administers.

Attack surface

Reachable over the network via the product's web interface (CVSS vector AV:N), requiring only a low-privileged authenticated account (PR:L) and no user interaction (UI:N). No pre-auth path is described in the record.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, which are vendor advisories only. EPSS is very high (0.79, ~99.6th percentile), indicating strong predicted likelihood of exploitation, but the record provides no confirmed in-the-wild evidence.

What to do

• Apply the vendor updates referenced in the ManageEngine advisory for CVE-2022-37024 (builds dated 2022-07-29/30) to all affected products.
• If immediate patching is not possible, restrict network access to the affected web interfaces to trusted management networks only.
• Review and reduce the number of accounts with access to these products; remove or disable unused and default accounts.
• Monitor and alert on unexpected database modifications made through the application by authenticated users.
• Segment management servers from general user networks to limit the blast radius of a compromised instance.

Detection

• Audit application and database logs for authenticated users performing unusual schema or data modification operations, especially outside change windows.
• Alert on unexpected child processes spawned by the ManageEngine product's Java/web service processes.
• Monitor for new or modified files, scripts or scheduled tasks on hosts running the affected products.
• Correlate authentication events with subsequent database write activity from the same account or session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.