Proof-of-concept exploit code for a known vulnerability in Zoho ManageEngine is likely to be published this week. The pre-authentication remote code execution flaw can be exploited to take control of vulnerable systems. Zoho released updates to address the vulnerability last fall. Note The flaw stems from a flaw in the Apache Santuario third-party plugin which …
Zoho
Updated on 2022-09-23: CISA Adds Critical Zoho Flaw to Known Exploited Vulnerabilities Catalog The US Cybersecurity and Infrastructure Security Agency (CISA) has added a Java deserialization vulnerability in Zoho ManageEngine products to its Known Exploited Vulnerabilities (KEV) catalog. The critical flaw affects ManageEngine PAM360, Password Manager Pro, and Access Manager Plus. CISA has given federal …