ManageEngine vulnerabilities (CVEs)

100 CVEs matched to ManageEngine by name in NVD, none on CISA's Known Exploited list.

Back to the ManageEngine profile · Alternatives to ManageEngine · CVE RSS feed

Exploitation riskProbably exploited

100 of 100 CVEs assessed

confirmed exploited

EPSS ≥ 10%

>99%

highest single CVE

22 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2017-11512 ↗EPSS 80%LEV ≥>99%Probably exploited
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the …
CVE-2015-8249 ↗EPSS 74%LEV ≥>99%Probably exploited
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the Connectio…
CVE-2017-11346 ↗EPSS 43%LEV ≥>99%Probably exploited

Recent changes

last 90 days

CVE-2017-11346 exploitation forecast rose from 37.2% to 43.3% in a day.2026-09-22 · NVD ↗
CVE-2017-11512 exploitation forecast rose from 52.5% to 79.6% in a day.2026-09-22 · NVD ↗
CVE-2015-8249 exploitation forecast rose from 67.9% to 73.6% in a day.2026-09-22 · NVD ↗
CVE-2017-11512 exploitation forecast rose from 52.5% to 79.6% in a day.2026-09-06 · NVD ↗
CVE-2015-8249 exploitation forecast rose from 67.9% to 73.6% in a day.2026-09-06 · NVD ↗
CVE-2017-11346 exploitation forecast rose from 37.2% to 43.3% in a day.2026-09-06 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Total
2017	7	7	6	0	20
2015	0	4	10	2	16
2014	0	12	12	1	25
2012	0	1	7	0	8
2011	0	1	10	0	11
2010	0	1	1	0	2
2009	0	0	2	0	2
2008	0	0	8	1	9
2007	0	1	3	1	5
2006	0	0	1	0	1
2005	0	0	1	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2014-5445	98%	>99%
CVE-2014-6037	84%	>99%
CVE-2015-7766	81%	>99%
CVE-2015-7387	80%	>99%
CVE-2014-7866	80%	>99%
CVE-2017-11512	80%	>99%
CVE-2014-6034	79%	>99%
CVE-2014-5005	78%	>99%
CVE-2015-8249	74%	99%
CVE-2014-7868	73%	99%

Known CVEs (100)

RSS ⇢

CVE-2017-16847 ↗EPSS 17%CRITICAL 9.82017
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action.
CVE-2017-16846 ↗EPSS 17%CRITICAL 9.82017
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to ManageEngine by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.