Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical vulnerability in several ManageEngine products allows for remote code execution (RCE) without authentication. This vulnerability is tracked as CVE-2022-47966 and is caused by an outdated third-party dependency, Apache Santuario. This vulnerability affects almost all ManageEngine products and allows unauthenticated attackers to execute arbitrary code if the SAML-based single-sign-on (SSO) is or was enabled at least once before the attack.

thn 7

packetstorm 3

saint 2

impervablog 1

talosblog 2

nessus 5

cve 1

zdt 3

rapid7blog 6

cisa_kev 1

metasploit 3

redhatcve 1