CVE-2022-40770

What it actually does

This vulnerability is an authenticated command injection issue in Zoho ManageEngine ServiceDesk Plus 13010 and earlier, and related ManageEngine ServiceDesk Plus MSP and SupportCenter Plus products. A high-privileged authenticated user can submit crafted input to a vulnerable server-side function that is incorporated into an operating-system command without sufficient validation or escaping. Successful exploitation allows arbitrary commands to run on the ManageEngine application server with the privileges of the application service account, potentially enabling full compromise of confidentiality, integrity, and availability on that host.

Why it matters to the business

An attacker who obtains or already has a high-privileged ManageEngine account could turn administrative application access into operating-system-level control of the server. This may lead to theft of helpdesk data, credential exposure, service outage, tampering with tickets or support workflows, malware deployment, and lateral movement into other internal systems. Although it is not currently listed in CISA KEV and public exploit maturity is not confirmed, the EPSS score is high, so exposed or broadly accessible installations should be treated as a priority.

How an attack unfolds

An attacker first needs access to a high-privileged account in the affected ManageEngine application, such as through stolen credentials, phishing, password reuse, or abuse of an existing administrative role. After logging in, the attacker accesses the vulnerable administrative functionality and submits a crafted value containing operating-system command syntax or shell metacharacters. The server processes that value and passes it into an OS command context, causing the injected command to execute on the underlying host. The attacker can then run reconnaissance commands, create or download files, add persistence, read configuration files, extract credentials, connect to external infrastructure, or pivot further from the ManageEngine server.

How to fix it

Upgrade affected ManageEngine ServiceDesk Plus installations running version 13010 or earlier to a vendor-supported fixed or latest available build. Also update ManageEngine ServiceDesk Plus MSP and ManageEngine SupportCenter Plus deployments to the latest vendor-recommended fixed releases. If immediate upgrade is not possible, restrict access to administrative interfaces to trusted management networks, enforce MFA for privileged users, review and reduce high-privilege roles, block direct internet exposure, and monitor closely for command execution from the application process. Rotate credentials that may be stored on or accessible from the ManageEngine server if exploitation is suspected.

How to confirm the fix worked

Confirm the installed product and build number from the ManageEngine administration console or server version files and verify it is newer than ServiceDesk Plus 13010, or otherwise matches the vendor’s fixed release guidance for the specific product line. Validate that administrative web interfaces are not publicly reachable unless explicitly required and protected by strong access controls. After patching, perform an authenticated vulnerability scan or configuration review to confirm the instance is no longer reported as vulnerable. Review application behavior to ensure the ManageEngine Java service is not spawning unexpected shell, scripting, or network utility processes.

Typical attack path

1. Obtain high-privileged credentials for the affected ManageEngine application.
2. Authenticate to the ServiceDesk Plus, ServiceDesk Plus MSP, or SupportCenter Plus web interface.
3. Identify and access the vulnerable administrative function.
4. Submit crafted input containing command-injection syntax.
5. Execute operating-system commands under the ManageEngine service account context.
6. Perform host reconnaissance, credential access, data staging, or malware deployment.
7. Use the compromised server for persistence, exfiltration, denial of service, or lateral movement.

How to detect it

To determine whether exploitation already occurred, correlate ManageEngine application logs with operating-system process, authentication, and network telemetry. Review web access logs and application logs for high-privilege sessions invoking unusual administrative functions, malformed parameters, encoded payloads, command separators, or repeated error responses. On Windows, review Security Event ID 4688, Sysmon Event ID 1, PowerShell logs, scheduled task events, service creation events, and outbound firewall/proxy logs. On Linux, review auditd process execution logs, shell history where available, cron changes, systemd service modifications, and outbound network connections. A key behavioral indicator is the ManageEngine Java application process spawning command shells, scripting engines, download tools, archive utilities, or network reconnaissance tools. Also look for newly created files in application directories, unexpected web-accessible files, modified startup scripts, new local users, new scheduled tasks, new services, and outbound connections shortly after privileged application activity.

• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> wscript.exe
• java.exe -> cscript.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java.exe -> curl.exe
• java.exe -> wget.exe
• java -> /bin/sh
• java -> /bin/bash
• cmd.exe /c
• powershell -enc
• powershell -EncodedCommand
• certutil -urlcache -split -f
• bitsadmin /transfer
• wget http://
• curl http://
• /bin/sh -c
• /bin/bash -c
• nc -e
• ncat -e
• python -c
• perl -e
• ManageEngine\ServiceDesk\logs\serverout
• ManageEngine\ServiceDesk\logs\wrapper.log
• ManageEngine\ServiceDesk\logs\access_log
• ManageEngine\ServiceDesk\logs\securitylog
• ManageEngine/ServiceDesk/logs/serverout
• ManageEngine/ServiceDesk/logs/wrapper.log
• ManageEngine/ServiceDesk/logs/access_log
• ManageEngine/ServiceDesk/logs/securitylog

What your security team should do

• Prioritize patching or upgrading all affected ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus deployments, especially internet-accessible or broadly reachable instances.
• Inventory all ManageEngine deployments and identify any running ServiceDesk Plus 13010 or earlier, plus affected MSP and SupportCenter Plus versions.
• Restrict administrative access to trusted networks, VPNs, or bastion hosts; remove direct internet exposure where possible.
• Enforce MFA and least-privilege role assignments for all high-privileged ManageEngine accounts.
• Review privileged account activity around the application for suspicious administrative actions followed by host-level command execution.
• Enable or tune process creation logging on the application server to detect Java spawning shells, scripting engines, download utilities, or reconnaissance tools.
• If suspicious activity is found, isolate the server, preserve logs and disk evidence, rotate application, database, LDAP, SSO, and service account credentials, and investigate lateral movement.