Is CVE-2022-47966 (Zoho ManageEngine Multiple Products Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2022-47966 to its Known Exploited Vulnerabilities catalogue on 23 January 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

Why CISA Treats This as Active Exploitation

CVE-2022-47966 is not just a theoretical flaw, it is in the class of vulnerabilities that move from disclosure to confirmed abuse quickly because they can be reached remotely and used for code execution. For practitioners, the key question is not whether exploitation is possible, but whether the affected products are exposed and whether the compromise window has already been open long enough to matter.

When CISA places a CVE in the KEV catalogue, the operational assumption should shift from routine patch planning to urgent exposure management. The practical issue is that internet-facing management software often sits in a privileged position, so a successful exploit can become a foothold for deeper access, lateral movement, and follow-on payload delivery.

What the Vulnerability Means for Zoho ManageEngine Deployments

This issue affects multiple Zoho ManageEngine products through an unauthenticated remote code execution condition tied to an outdated third-party dependency, Apache Santuario. That combination is especially dangerous because no valid user account is required before the attacker attempts code execution, which makes exposed instances attractive for mass scanning and opportunistic exploitation.

If you operate any ManageEngine product in production, assume the risk is not limited to the vulnerable component itself. The management plane may hold administrative credentials, service integrations, inventory data, or remote administration pathways, so a successful exploit can expose far more than the application process that was initially targeted.

For version-specific remediation and vendor instructions, use the CISA Known Exploited Vulnerabilities Catalog and the relevant vendor advisory rather than relying on secondary summaries. If you need a broader response model for an actively exploited CVE, the Zero-Day and Exploited Vulnerabilities Guide is useful for triage, emergency mitigation, and post-patch hunting.

What to Check If You Suspect Exposure

Start with inventory and reachability, then move to evidence of exploitation. Confirm whether any ManageEngine instance is internet-facing, whether it is reachable from trusted administrative networks that are also broadly accessible, and whether there are logs, child processes, unexpected command execution, or new accounts that appeared around the first signs of compromise.

If you cannot patch immediately, treat the system as potentially exposed rather than merely vulnerable. Isolate it, restrict inbound access to the minimum administrative paths, preserve logs before rotation or cleanup, and look for indicators that the attacker used the product as an initial access point for credential theft or remote execution of follow-on tooling.

Risk and Threat Considerations

This type of flaw is high risk because unauthenticated remote code execution on administrative software often leads to full environment compromise, not just application failure. Once an attacker can execute code in a trusted management product, they can often pivot to credentials, config data, or adjacent hosts.

Failure mechanism: Internet-reachable management software accepts crafted requests that trigger code execution before authentication, allowing an attacker to gain an initial foothold without prior access.

Impact: The attacker may steal secrets, implant persistence, or use the compromised platform to move laterally and stage ransomware or other destructive activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes rapid remediation and exposure closure central.
	IR-4 — Incident Handling	Suspected exploitation requires containment, evidence preservation, and investigation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Compromise checks depend on reviewing logs for exploit activity and follow-on actions.
Recommendation — Accelerate remediation for the vulnerable ManageEngine deployment and track closure to completion. Contain the affected system and investigate for compromise before returning it to service. Review relevant logs for signs of exploitation, payload execution, and post-exploit activity.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed RCEs require prioritised scanning and remediation based on exploitation status.
Recommendation — Prioritise scanning and remediation for KEV-listed internet-facing assets first.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Exposure assessment starts by identifying vulnerable assets and their reachability.
Recommendation — Identify every exposed ManageEngine instance and rank it by exploitable risk.

Practitioner Guidance

What to prioritise: Treat exposure of ManageEngine products as a containment problem first. If the instance is reachable from the internet, or from broad administrative networks, prioritise isolation and verification of compromise before longer-term remediation work.

What to verify: Preserve and inspect authentication logs, web access logs, process creation data, and any evidence of new binaries, scripts, scheduled tasks, or unexpected outbound connections. If the system holds privileged integrations, verify whether those credentials or tokens were used elsewhere after the suspected compromise window.

Practitioner takeaway: For actively exploited management-plane RCEs, the decision is not just whether to patch, but whether to assume the host and its surrounding credentials are already contaminated until proven otherwise.