CVE-2022-36412

9.8 criticalEPSS 5.4%

Critical (9.8) in zohocorp manageengine supportcenter plus. EPSS 5.4% chance of exploitation in the next 30 days.

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with the credentials of a user who authenticated in the past.)

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2022-07-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zohocorp:manageengine_supportcenter_plus

References

https://www.manageengine.com/products/support-center/cve-2022-36412.html
https://www.manageengine.com/products/support-center/cve-2022-36412.html

Check your stack JSON