CVE-2022-38772: ManageEngine OpManager and related products NMAP feature RCE via authenticated DB changes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and low-privilege authentication, combined with a very high EPSS score, makes this a high-priority patch despite no KEV listing.

What it is

Multiple Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, OpUtils) before specified builds allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. The flaw requires only low-privileged authentication and no user interaction, making it a serious post-authentication escalation path in widely deployed IT operations tooling.

Impact

An authenticated attacker can execute arbitrary code on the affected server, gaining full control of confidentiality, integrity and availability of the host and its data. This can pivot into the broader managed network the product monitors.

Attack surface

Reachable over the network via the product's web interface (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The vulnerable path is the NMAP feature, which is manipulated through database changes made by an authenticated user.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.78 (99.55th percentile), indicating strong predicted exploitation activity. References are vendor advisories only, with no public exploit tags supplied.

What to do

• Apply the vendor fixed builds (125658, 126003, 126105, 126120 or later) for all affected products immediately.
• Restrict network access to the ManageEngine web interfaces to trusted administrative networks and VPN only.
• Audit and minimize accounts with access to the NMAP feature; enforce least privilege and remove unused accounts.
• Monitor database changes made through the application for unauthorized or anomalous modifications.
• Where patching is delayed, consider disabling or restricting the NMAP feature if operationally feasible.

Detection

• Monitor application and database logs for unexpected changes to NMAP-related configuration or tables.
• Alert on suspicious child processes spawned by the ManageEngine service or web server (e.g., shells, scripting interpreters).
• Review authentication logs for low-privileged accounts accessing NMAP functionality or making unusual database writes.
• Watch for outbound connections from the ManageEngine host to unexpected destinations following NMAP feature use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.