CVE-2022-47966: Zoho ManageEngine SAML SSO RCE

CVE-2022-47966 is an unauthenticated remote code execution vulnerability affecting roughly two dozen on-premises Zoho ManageEngine products that bundle an outdated, vulnerable version of the Apache Santuario XML security library; any instance where SAML single sign-on has ever been configured — even if since disabled — is exploitable, and CISA documented nation-state APT actors exploiting it (alongside a separate firewall CVE) within days of public disclosure to deploy web shells and dump credentials.

CVE-2022-47966 affects multiple on-premises Zoho ManageEngine products, including ServiceDesk Plus, ADSelfService Plus and Endpoint Central. The root cause is a bundled, outdated copy of Apache Santuario (XML Security for Java) 1.4.1: that library's XSLT transform feature is, by its own 1.4.1-era design, the calling application's responsibility to restrict, and ManageEngine's SAML single-sign-on handling did not apply those restrictions. As a result, a remote attacker with no credentials can send a crafted SAML response that triggers unauthorized XSLT execution and achieves remote code execution on the server — and critically, the product is vulnerable if SAML SSO was ever enabled at any point, even if it has since been turned off, because the vulnerable code path remains reachable (ManageEngine Security Advisory CVE-2022-47966).

NVD's own analysis rates the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability (NVD).

ManageEngine's advisory lists fixed builds for 24 affected on-premises products; for example ServiceDesk Plus build 14003 and below is fixed in 14004, Access Manager Plus 4307 and below is fixed in 4308, ADSelfService Plus 6210 and below is fixed in 6211, and Password Manager Pro 12123 and below is fixed in 12124 — cloud/on-demand editions of these products are not affected (ManageEngine Security Advisory CVE-2022-47966).

CISA added CVE-2022-47966 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-01-23 with a required-action due date of 2023-02-13, and flags known ransomware campaign use. A CISA/FBI joint advisory on nation-state exploitation of ManageEngine ServiceDesk Plus documented that, starting 2023-01-18, actors sent requests with a "Hello World" user-agent to a vulnerable instance, and by 2023-01-20/21 had successfully exploited it, created a local administrator account named "Azure" for persistence, dumped LSASS credentials, and deployed web shells to Outlook Web Access and other servers as part of a broader intrusion that also abused a separate firewall vulnerability, CVE-2022-42475, for initial access (CISA AA23-250A).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.99753 (99.955th percentile), consistent with a vulnerability that remains actively targeted years after disclosure (FIRST EPSS).

Any on-premises ManageEngine product that has ever had SAML SSO configured should be updated to its fixed build immediately regardless of whether SSO is currently enabled, and instances exposed to the internet before patching should be checked for signs of prior compromise given the documented nation-state exploitation.

• An outdated, bundled Apache Santuario (XML Security for Java) 1.4.1 in multiple on-premises Zoho ManageEngine products lets a remote unauthenticated attacker trigger unauthorized XSLT execution via a crafted SAML response, achieving RCE; any instance that has ever had SAML SSO enabled is exploitable even if since disabled. — ManageEngine Security Advisory CVE-2022-47966
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
• 24 on-premises ManageEngine products affected with per-product fixed builds, e.g. ServiceDesk Plus 14003-and-below fixed in 14004, Access Manager Plus 4307-and-below fixed in 4308, ADSelfService Plus 6210-and-below fixed in 6211, Password Manager Pro 12123-and-below fixed in 12124; cloud editions unaffected. — ManageEngine Security Advisory CVE-2022-47966
• Added to the CISA Known Exploited Vulnerabilities catalog on 2023-01-23, due date 2023-02-13, with known ransomware campaign use; CISA/FBI joint advisory documents nation-state exploitation of ServiceDesk Plus from 2023-01-18, including a 'Hello World' user-agent probe, an admin account named 'Azure' created for persistence, LSASS credential dumping and web shell deployment, chained with CVE-2022-42475. — CISA AA23-250A
• EPSS score is 0.99753 (99.955th percentile) as of 2026-10-30. — FIRST EPSS