CVE-2022-28810 is an adselfservice plus remote code execution vulnerability in Zoho ManageEngine. CISA added it to the Known Exploited Vulnerabilities catalogue on 7 March 2023, which means attackers have used it in real attacks. Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
What this vulnerability means in practice
CVE-2022-28810 is an authenticated or workflow-adjacent remote code execution issue in a password change or reset path, which makes it dangerous because that path is often reachable by ordinary users, support staff, or exposed self-service portals. When a product that handles identity recovery can be driven into code execution, compromise can move quickly from a single request into full application control.
This class of flaw is especially serious in externally reachable administration or self-service software because it can bypass the normal trust assumptions around account recovery. If an attacker can influence the reset workflow, the vulnerability can become a direct entry point rather than merely a reliability defect.
Why password reset paths are high-value targets
Password reset and change functions sit close to the boundary between user convenience and privileged account recovery. They often process sensitive session state, account identifiers, and one-time tokens, so a memory corruption, input handling, or deserialization weakness in that path can have a wider blast radius than the same bug elsewhere in the product.
For defenders, that means the business function itself matters: a vulnerability in this workflow can affect both internal admin access and end-user authentication recovery. For attackers, it is attractive because compromise of the application layer can expose stored secrets, configuration, and connected identity data, not just the server process.
How to assess exposure and scope
The first exposure question is whether the product is deployed anywhere that users can reach the password reset or self-service interface, whether directly from the internet or through reverse proxies and published portals. Organisations should confirm the asset inventory, identify every instance of the product, and compare that inventory against the vendor advisory and the NIST National Vulnerability Database and the CVE Program record for authoritative vulnerability identification.
Because CISA placed this CVE in the KEV catalogue, exposure should be treated as operationally urgent wherever the product is still present. If the application is internet-facing, or if it mediates privileged account recovery, the likelihood of abuse is materially higher than for an isolated internal test instance.
Remediation, detection, and recovery considerations
Patch or upgrade using the vendor’s instructions as the primary remediation path, and verify that every exposed instance is covered. Where immediate patching is not possible, reduce reachability, restrict access to the reset workflow, and apply compensating controls such as segmentation, strong administrative separation, and temporary service restriction until the fix is in place.
After remediation, review for signs of compromise in the application host, supporting infrastructure, and connected directories or helpdesk functions. A remote code execution event can leave behind webshells, modified configuration, unusual child processes, or changes to credentials and sessions that outlive the original exploit attempt.
Risk and Threat Considerations
Self-service identity products are high-impact targets because a single exploitable workflow can provide code execution in a system that already has access to accounts, sessions, and recovery logic. If attackers gain a foothold through the reset path, they may pivot to credential theft, persistence, or broader administrative compromise.
Failure mechanism: A flaw in the password change or reset flow allows attacker-controlled input to reach an execution context, turning a trusted identity function into an application compromise path.
Impact: The result can include service takeover, manipulation of account recovery, theft of secrets or sessions, and follow-on access to connected identity systems or internal services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires prompt flaw remediation and verified coverage across deployed instances. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on finding every instance and confirming internet-facing reachability. | |
| AC-17 — Remote Access | The vulnerable reset path can be externally reachable and should be constrained where possible. | |
| Recommendation — Prioritise SI-2 to track, remediate, and verify the vulnerable product across your estate. Use RA-5 to inventory affected deployments and validate exposure before and after remediation. Apply AC-17 to limit remote access to the affected service until it is remediated. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term is an exploited CVE, so continuous identification, prioritisation, and remediation are central. |
| CIS-12 — Network Infrastructure Management | Compensating containment relies on reducing exposure and constraining reachable paths. | |
| Recommendation — Use CIS-7 to identify, prioritise, and remediate the affected software quickly. Use CIS-12 to segment and restrict access to the vulnerable service while remediation is pending. | ||
Practitioner Guidance
Why practitioners should care: Treat password recovery features as security-critical attack surface, not convenience features. In products that manage access to accounts, a vulnerability here can invalidate assumptions about who controls recovery, who can reset what, and how quickly a compromise can spread.
What to watch for: Unexpected process execution, anomalous web requests to reset endpoints, new files in application directories, and signs that administrative or directory-linked accounts changed without a matching helpdesk or user action.
Practitioner takeaway: Prioritise exposure reduction and compromise review together, because patching alone does not prove that the vulnerable workflow was not already abused.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org