CVE-2023-31099

What it actually does

CVE-2023-31099 is an authenticated remote code execution vulnerability in Zoho ManageEngine OpManager through build 126323 involving probe server functionality. A network-accessible attacker with valid low-privileged application credentials can abuse probe-server related operations to cause attacker-controlled code or commands to execute on the OpManager system. Because OpManager commonly runs with elevated service privileges and has broad visibility into monitored infrastructure, successful exploitation can compromise confidentiality, integrity, and availability of the monitoring platform and potentially provide a pivot point into managed networks.

Why it matters to the business

A compromised OpManager deployment can disrupt infrastructure monitoring, hide outages or malicious activity, expose sensitive operational data, and give attackers a foothold in systems used to manage or observe critical servers, network devices, and applications. The CVSS score is high and the EPSS score is very elevated, indicating meaningful likelihood of exploitation in the wild even though it is not currently listed in CISA KEV. Organizations using affected builds should treat remediation as urgent because monitoring platforms are high-value targets and are often trusted by many parts of the environment.

How an attack unfolds

An attacker first obtains or abuses valid OpManager credentials, such as through phishing, password reuse, credential theft, or compromise of a low-privileged account. The attacker then accesses the OpManager web interface or API over the network and interacts with probe server functionality in a way that causes the server to process attacker-controlled input as executable code or commands. If successful, the payload runs on the OpManager host under the privileges of the OpManager service account. From there, the attacker may deploy a web shell or remote access tool, run operating-system discovery commands, steal application secrets and configuration files, tamper with monitoring data, create persistence, or pivot to assets monitored by the platform.

How to fix it

Upgrade Zoho ManageEngine OpManager to a vendor-supported build newer than 126323 that contains the fix for this vulnerability. If an exact fixed build is not available in asset records, consult Zoho/ManageEngine advisories and release notes and upgrade to the latest available OpManager build. Until upgraded, restrict OpManager access to trusted administrative networks, disable or limit probe server functionality where operationally feasible, enforce MFA for all OpManager users, remove unused accounts, apply least privilege to application roles, and ensure the OpManager service runs with the minimum required operating-system privileges. Review stored credentials and integration secrets after patching if compromise is suspected.

How to confirm the fix worked

Confirm the installed OpManager build is later than 126323 and that all distributed components, probe servers, and related agents are updated consistently. Verify the OpManager web interface and API are not exposed to untrusted networks. Test that only authorized administrators can access probe server management functions. Review vendor release notes or application About/System Information pages to confirm the patched build. After remediation, perform an authenticated regression test of probe server workflows and review application, web, and operating-system logs for errors or unexpected command execution attempts.

Typical attack path

1. Identify an internet-facing or internally reachable Zoho ManageEngine OpManager instance.
2. Obtain valid application credentials through theft, reuse, phishing, brute force against weak passwords, or prior compromise.
3. Log in to the OpManager interface or call authenticated endpoints associated with probe server functionality.
4. Submit crafted probe-server related input that triggers command or code execution on the OpManager server.
5. Execute initial reconnaissance commands to determine user context, operating system, network reachability, and installed tools.
6. Deploy a persistent payload such as a web shell, scheduled task, service, or remote access tool.
7. Access OpManager configuration, stored credentials, monitored device data, and integration secrets.
8. Use the monitoring server’s trust and network position to move laterally or disrupt visibility.

How to detect it

Investigate whether authenticated users accessed or modified probe server functionality shortly before suspicious host activity. Review Zoho ManageEngine OpManager application logs, web access logs, audit/admin logs, probe server logs, and operating-system security logs for unusual logins, new or modified probe configurations, unexpected file uploads, script execution, and errors around probe operations. On Windows, examine Security, System, PowerShell, and Task Scheduler logs for commands or processes launched by the OpManager service account. On Linux, examine shell history, syslog/auditd, cron, systemd, and process accounting for activity under the OpManager service user. Hunt for web shells or dropped tools in OpManager installation directories, temporary directories, upload directories, and web application paths. Look for unexpected child processes spawned by Java or OpManager service processes, including command shells, scripting engines, network utilities, archiving tools, or credential dumping tools. Correlate suspicious activity with successful OpManager logins from unfamiliar IP addresses, new user agents, impossible travel, off-hours administrative actions, and outbound connections from the OpManager host to unknown external infrastructure. Because this issue requires authentication, also review identity logs for credential compromise preceding application activity.

• OpManager build <= 126323
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java.exe spawning wscript.exe
• java.exe spawning cscript.exe
• java.exe spawning certutil.exe
• java.exe spawning bitsadmin.exe
• java.exe spawning rundll32.exe
• java.exe spawning regsvr32.exe
• java spawning /bin/sh
• java spawning /bin/bash
• java spawning curl
• java spawning wget
• java spawning nc
• java spawning ncat
• java spawning python
• java spawning perl
• ManageEngine OpManager service account executing cmd.exe
• ManageEngine OpManager service account executing powershell.exe
• ManageEngine OpManager service account executing /bin/sh
• ManageEngine OpManager service account executing /bin/bash
• unexpected files under ManageEngine/OpManager/webapps
• unexpected files under ManageEngine/OpManager/probe
• unexpected files under ManageEngine/OpManager/temp
• unexpected .jsp files under ManageEngine/OpManager
• probe server modified
• probe server added
• probe server deleted
• probe server configuration changed
• successful OpManager login from unfamiliar IP
• OpManager administrative action outside business hours

What your security team should do

• Prioritize upgrade of all Zoho ManageEngine OpManager instances running build 126323 or earlier, especially internet-facing deployments.
• Inventory OpManager servers, probe servers, and related components; verify build numbers and network exposure.
• Restrict access to OpManager administration interfaces using VPN, firewall rules, allowlists, or privileged access gateways.
• Enforce MFA and strong password policy for OpManager accounts; review accounts for stale, shared, or overprivileged users.
• Audit recent OpManager logins, probe server changes, file uploads, script execution, and administrative actions for suspicious activity.
• Hunt on OpManager hosts for unexpected child processes spawned by the application service, web shells, new scheduled tasks, unknown services, and unauthorized configuration changes.
• Rotate credentials stored in or accessible from OpManager if exploitation is suspected, including device credentials, database passwords, API keys, and integration tokens.
• Monitor for outbound connections from OpManager servers to unusual external IP addresses or newly observed internal systems.
• Ensure OpManager is covered by endpoint detection, file integrity monitoring, centralized logging, and backup/restore procedures.
• Treat confirmed exploitation as a potential infrastructure-management platform compromise and perform broader lateral movement and credential theft investigation.