CVE-2023-23076: ManageEngine SupportCenter Plus OS command injection in schedules

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required and a very high EPSS score make this a top remediation target despite the absence of KEV listing.

What it is

ManageEngine SupportCenter Plus 11 contains an OS command injection flaw reached through the Executor in Action when creating new schedules. Because the command runs with the application's privileges, a successful injection can compromise the host. The record gives no affected build numbers beyond the version 11 mention in the description.

Impact

An attacker can execute arbitrary operating system commands on the SupportCenter Plus server, leading to full loss of confidentiality, integrity and availability of that host.

Attack surface

The flaw is network reachable per the CVSS vector (AV:N) with no privileges or user interaction required (PR:N, UI:N), meaning it can be triggered directly against the scheduling functionality.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is recorded in the references, but EPSS is very high at 0.7427 (99.46th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor fix referenced in the ManageEngine advisory for CVE-2023-23076.
• Restrict network access to the SupportCenter Plus web interface to trusted management networks or VPN.
• Audit and remove unnecessary accounts or roles that can create schedules, and review existing scheduled tasks for unexpected entries.
• Run the service under a least-privilege OS account so injected commands cannot gain administrative rights.
• Monitor the vendor advisory page for updated affected-version details before assuming any build is safe.

Detection

• Review SupportCenter Plus logs for schedule creation events containing shell metacharacters or unexpected command strings.
• Monitor child processes spawned by the SupportCenter Plus service account for shells or system utilities.
• Alert on outbound network connections or file writes originating from the SupportCenter Plus host that are not part of normal operation.
• Correlate schedule-creation activity with subsequent process execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.