Vulnerabilities in Zoho's ManageEngine suite — ADSelfService Plus, ADAudit Plus, ServiceDesk Plus, and adjacent identity and IT-management tools — where authentication bypasses and unauthenticated RCEs draw APT groups and ransomware operators as quickly as CVEs are published. Combined article + CVE feed for the Zoho beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2019-8394/https://0daynews.com/cve/cve-2019-8394/Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.Thu, 03 Sep 2026 00:00:00 GMTZohomediumcvehttps://0daynews.com/cve/cve-2020-10189/https://0daynews.com/cve/cve-2020-10189/Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.Thu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2021-37415/https://0daynews.com/cve/cve-2021-37415/Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticationThu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2021-40539/https://0daynews.com/cve/cve-2021-40539/Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.Thu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2021-44077/https://0daynews.com/cve/cve-2021-44077/Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code executionThu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2021-44515/https://0daynews.com/cve/cve-2021-44515/Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.Thu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2022-28810/https://0daynews.com/cve/cve-2022-28810/Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.Thu, 03 Sep 2026 00:00:00 GMTZohomediumcvehttps://0daynews.com/cve/cve-2022-35405/https://0daynews.com/cve/cve-2022-35405/Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.Thu, 03 Sep 2026 00:00:00 GMTZohocriticalcvehttps://0daynews.com/cve/cve-2022-47966/https://0daynews.com/cve/cve-2022-47966/Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.Thu, 03 Sep 2026 00:00:00 GMTZohocriticalcve