CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cve@mitre.org

Published

2022-08-10

Last modified

2025-08-27

Weaknesses

CWE-284, CWE-755

Affected products

• Manageengine Firewall Analyzer (Zohocorp)
• Manageengine Netflow Analyzer (Zohocorp)
• Manageengine Network Configuration Manager (Zohocorp)
• Manageengine Opmanager (Zohocorp)
• Manageengine Opmanager Msp (Zohocorp)
• Manageengine Opmanager Plus (Zohocorp)
• Manageengine Oputils (Zohocorp)

References

• https://www.manageengine.com/itom/advisory/cve-2022-36923.html