Cyberfeed6 › Vendors › Zoho
CISA lists 9 Zoho vulnerabilities as exploited in real attacks, and 2 of them are known to be used in ransomware campaigns. Most entries concern ManageEngine, Desktop Central, ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus, ManageEngine ServiceDesk Plus (SDP).
Showing the 9 most recently added of 9. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2022-28810Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | ManageEngine | 2023-03-07 | Medium (6.8) | No | Vendor notice |
| CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | ManageEngine | 2023-01-23 | Critical (9.8) | Yes | Vendor notice |
| CVE-2022-35405Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | ManageEngine | 2022-09-22 | Critical (9.8) | No | Vendor notice |
| CVE-2021-44515Zoho Desktop Central Authentication Bypass Vulnerability | Desktop Central | 2021-12-10 | Critical (9.8) | No | |
| CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | 2021-12-01 | Critical (9.8) | No | |
| CVE-2021-37415Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | ManageEngine ServiceDesk Plus (SDP) | 2021-12-01 | Critical (9.8) | No | |
| CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | ManageEngine | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability | ManageEngine | 2021-11-03 | Critical (9.8) | No | |
| CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability | ManageEngine | 2021-11-03 | High (7.5) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.