CVE-2022-47966

What it actually does

This is an unauthenticated remote code execution vulnerability in multiple on-premises Zoho ManageEngine products that use Apache Santuario XML Security for Java 1.4.1 in SAML single sign-on processing. The vulnerable xmlsec XSLT functionality can be abused when the application fails to enforce safe XML/XSLT processing controls, allowing attacker-supplied SAML content to trigger code execution in the context of the ManageEngine application service. Exposure depends on SAML SSO having been configured at least once for the product; for some products SAML SSO must still be active. Successful exploitation can lead to full compromise of the application server, including command execution, web shell deployment, credential theft, lateral movement, and service disruption.

Why it matters to the business

This vulnerability has critical operational impact because affected ManageEngine products often manage identity, endpoints, passwords, privileged access, patching, help desk, monitoring, and asset data. It is in the CISA Known Exploited Vulnerabilities catalog, has been used in ransomware activity, and has an extremely high EPSS likelihood of exploitation, so internet-exposed or broadly reachable instances should be treated as high-priority compromise risks. A successful attacker may gain control of administrative platforms, steal sensitive credentials or configuration data, disable security tooling, deploy ransomware, or use the server as a foothold into the wider network.

How an attack unfolds

An attacker first identifies a reachable affected ManageEngine product and determines whether SAML SSO has been configured or is active. The attacker then sends a crafted SAML authentication request or response to the product’s SAML processing endpoint. Because the product relies on an older Apache Santuario xmlsec implementation with unsafe XSLT handling and lacks the required application-side protections, the crafted XML/XSLT content can cause the server-side Java process to execute attacker-controlled commands. After gaining code execution, the attacker typically runs discovery commands, writes a web shell or secondary payload, establishes persistence, downloads additional tooling, harvests credentials and configuration files, and pivots toward higher-value systems. Public exploitation and ransomware-linked activity mean defenders should assume that exposed unpatched systems may already have been targeted.

How to fix it

Upgrade affected Zoho ManageEngine products to fixed versions or later immediately. Fixed versions identified by the vendor include: Access Manager Plus 4308 or later; Active Directory 360 4310 or later; ADAudit Plus 7081 or later; ADManager Plus 7162 or later; ADSelfService Plus 6211 or later; Analytics Plus 5150 or later; Application Control Plus 10.1.2220.18 or later; Asset Explorer 6983 or later; Browser Security Plus 11.1.2238.6 or later; Device Control Plus 10.1.2220.18 or later; Endpoint Central 10.1.2228.11 or later; Endpoint Central MSP 10.1.2228.11 or later; Endpoint DLP 10.1.2137.6 or later; Key Manager Plus 6401 or later; OS Deployer 1.1.2243.1 or later; PAM 360 5713 or later; Password Manager Pro 12124 or later; Patch Manager Plus 10.1.2220.18 or later; Remote Access Plus 10.1.2228.11 or later; Remote Monitoring and Management 10.1.41 or later; ServiceDesk Plus 14004 or later; ServiceDesk Plus MSP 13001 or later; SupportCenter Plus 11026 or later; and Vulnerability Manager Plus 10.1.2220.18 or later. If the separate package metadata is applicable to a software inventory item, update lambda-science/impatient from source commit 38560a346f3fed99a73ae9729d6fb139ab0b823c or later. If immediate patching is not possible, disable SAML SSO where operationally feasible, restrict access to the product to trusted management networks or VPN, block direct internet exposure, and place additional monitoring on SAML endpoints. Because this vulnerability is actively exploited and ransomware-associated, remediation should include compromise assessment, credential rotation for secrets stored in or accessible from the product, review of administrative accounts and API tokens, and rebuilding from trusted media if post-exploitation artifacts are found.

How to confirm the fix worked

Confirm the installed product build is at or above the vendor-fixed version for the specific ManageEngine product. Verify that the vulnerable Apache Santuario xmlsec library version is no longer present in the application deployment or that the vendor patch has replaced/disabled unsafe XSLT processing paths. Review whether SAML SSO is enabled or was historically configured, because historical SAML configuration can be sufficient for exposure in some products. From an external and internal attack-surface perspective, verify that ManageEngine administrative interfaces are not reachable from untrusted networks unless explicitly required and protected. Validate logs after patching to ensure SAML authentication still functions normally without XML/XSLT processing errors. If exposure existed before patching, perform forensic validation by reviewing web access logs, application logs, file-system changes, service creation events, scheduled tasks, unusual child processes spawned by Java, and outbound network connections from the application server.

Typical attack path

1. Scan the internet or internal address space for affected ManageEngine products and version indicators.
2. Identify whether SAML SSO has been configured or enabled on the target product.
3. Send a crafted SAML message to the product’s SAML processing endpoint to trigger unsafe XML/XSLT processing.
4. Obtain command execution as the ManageEngine application service account.
5. Run reconnaissance commands to identify the operating system, privileges, installed tools, network access, and stored credentials.
6. Deploy a web shell, reverse shell, scheduled task, service, or other persistence mechanism.
7. Download post-exploitation tooling such as credential dumpers, tunneling utilities, remote access tools, or ransomware staging components.
8. Use credentials or trusted management-plane access to move laterally, disable defenses, exfiltrate data, or deploy ransomware.

How to detect it

Investigate application access logs for unexpected POST requests to SAML processing endpoints, especially from unfamiliar external IP addresses, automation user agents, or requests followed by server errors and then command execution. Review ManageEngine application logs for SAML parsing, XML signature, XSLT transformation, or xmlsec exceptions around the time of suspicious requests. On the host, inspect process creation telemetry for Java spawning operating-system shells or utilities such as cmd.exe, powershell.exe, bash, sh, curl, wget, certutil, bitsadmin, msiexec, rundll32, or python, because normal application behavior should not require these child processes. Search web application directories and product installation folders for recently created JSP, WAR, class, script, executable, archive, or DLL files. Review web server logs, EDR telemetry, Windows Event Logs, Linux audit logs, shell history, scheduled tasks, cron jobs, services, autoruns, and outbound network connections from the ManageEngine server. Look for post-exploitation patterns including web shells, encoded PowerShell, credential dumping tools, remote access tooling, tunneling utilities, ransomware staging, and anomalous connections to rare external hosts. If ransomware-linked activity is suspected, correlate with authentication logs, domain controller events, privilege escalation activity, mass file access, security tool tampering, backup deletion, and lateral movement from the ManageEngine host.

• /SamlResponseServlet
• SAMLResponse=
• <xsl:stylesheet
• <xsl:transform
• javax.xml.transform.TransformerException
• org.apache.xml.security
• xmlsec-1.4.1
• java.lang.Runtime
• ProcessBuilder
• cmd.exe /c
• powershell -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• msiexec.exe /i
• curl.exe http
• wget http
• java.exe spawned cmd.exe
• java.exe spawned powershell.exe
• java spawned /bin/sh
• java spawned /bin/bash
• webapps/ROOT/*.jsp
• webapps/*/*.jsp
• ManageEngine*/logs/serverout
• ManageEngine*/logs/access_log
• AdventNet/Sas/tomcat/webapps
• AdventNet\Sas\tomcat\webapps
• ManageEngine\ServiceDesk\applications\extracted
• ManageEngine\ADSelfService Plus\webapps
• ManageEngine\ADManager Plus\webapps
• ManageEngine\ADAudit Plus\webapps
• ManageEngine\PAM360\webapps
• ManageEngine\Password Manager Pro\webapps

What your security team should do

• Treat all unpatched affected ManageEngine instances as urgent remediation items because the vulnerability is in CISA KEV, is ransomware-associated, and has very high exploitation probability.
• Patch to the relevant fixed ManageEngine version immediately; do not rely on SAML disablement alone as a long-term control.
• Identify all ManageEngine deployments, including non-internet-facing administrative, help desk, endpoint management, password management, PAM, monitoring, and patching systems.
• Remove direct internet exposure where possible and restrict access to trusted administrative networks, VPN, or zero-trust access controls.
• Perform threat hunting for exploitation before the patch date and across at least 90 days of retained logs, prioritizing SAML endpoints, Java child processes, web shell artifacts, and suspicious outbound connections.
• Rotate credentials, API keys, SAML secrets, privileged passwords, and service account secrets stored in or accessible from affected products if exploitation is suspected or cannot be ruled out.
• Review product administrative users, newly created accounts, altered SSO settings, scheduled tasks, services, and startup locations for persistence.
• If web shells, suspicious command execution, or unauthorized administrative changes are found, isolate the host, preserve forensic evidence, rebuild from trusted media, and conduct incident response before returning the system to production.