CVE-2022-47966: Zoho ManageEngine on-premise products RCE via SAML SSO and xmlsec

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a 9.8 CVSS score, KEV listing with known ransomware use, and near-maximum EPSS probability.

What it is

Multiple Zoho ManageEngine on-premise products use Apache Santuario xmlsec 1.4.1, whose XSLT features by design leave certain security protections to the application; ManageEngine did not implement them, allowing remote code execution. The flaw affects a long list of products and is only reachable when SAML SSO has ever been configured, or in some products is currently active. It matters because it is unauthenticated, network-reachable, and rated critical.

Impact

An unauthenticated attacker can execute arbitrary code on the affected ManageEngine server, gaining full control of that host and any credentials or managed endpoints it administers.

Attack surface

Reached over the network via the SAML SSO handling path; the CVSS vector shows no privileges and no user interaction required. Exploitation is conditional: SAML SSO must have been configured at some point, and for some products must be currently active.

Exploitation

CISA added it to KEV on 2023-01-23 with a 2023-02-13 due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99753 (99.954th percentile) and multiple references are tagged Exploit.

What to do

• Apply the vendor updates listed in the ManageEngine advisory for each affected product (for example ServiceDesk Plus 14004, ADSelfService Plus 6211, Endpoint Central 10.1.2228.11, Password Manager Pro 12124).
• If a product cannot be patched immediately, disable or remove SAML SSO configuration where operationally possible, since exploitation depends on it.
• Restrict network access to ManageEngine web interfaces to trusted management networks rather than exposing them to the internet.
• Inventory all on-premise ManageEngine instances and versions to confirm which are affected and which have SAML SSO configured.
• Monitor vendor and CISA guidance for follow-up advisories, as this CVE is tied to a broader CISA advisory (aa23-250a).

Detection

• Review ManageEngine web server and application logs for anomalous SAML responses or requests to SSO endpoints, especially from unexpected source addresses.
• Hunt for unexpected child processes spawned by ManageEngine Java service processes, which would indicate post-exploitation code execution.
• Search for outbound connections or new files/webshells on ManageEngine hosts that do not match normal administrative activity.
• Correlate with KEV/EPSS-driven alerting and check whether any affected instance still has SAML SSO enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.