PatchSiren cyber security CVE debrief
CVE-2022-28810 Zoho CVE debrief
CVE-2022-28810 is a remote code execution vulnerability affecting Zoho ManageEngine ADSelfService Plus. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-07, which makes timely remediation a defensive priority for any organization running the product.
- Vendor
- Zoho
- Product
- ManageEngine
- CVSS
- Unknown
- CISA KEV
- Listed
- Original CVE published
- 2023-03-07
- Original CVE updated
- 2023-03-07
- Advisory published
- 2023-03-07
- Advisory updated
- 2023-03-07
Who should care
Administrators and security teams responsible for Zoho ManageEngine ADSelfService Plus deployments should treat this as a priority issue, especially where systems are production-facing or centrally managed.
Technical summary
The supplied source corpus identifies CVE-2022-28810 as a remote code execution issue in Zoho ManageEngine ADSelfService Plus. The CISA KEV record confirms it is a known exploited vulnerability and directs defenders to apply updates per vendor instructions. No CVSS score was provided in the supplied data.
Defensive priority
High. CISA’s KEV inclusion indicates confirmed exploitation risk, and the published remediation due date was 2023-03-28.
Recommended defensive actions
- Apply vendor updates per the vendor instructions referenced by CISA.
- Identify all installations of Zoho ManageEngine ADSelfService Plus in your environment.
- Confirm remediation was completed before or by the CISA KEV due date of 2023-03-28.
- Track this CVE in vulnerability management and exception workflows until every affected instance is verified remediated.
Evidence notes
The CISA Known Exploited Vulnerabilities feed lists CVE-2022-28810 as a Zoho ManageEngine ADSelfService Plus remote code execution vulnerability, with dateAdded 2023-03-07 and dueDate 2023-03-28. The CVE and NVD records corroborate the identifier and vulnerability classification. The supplied corpus did not include a CVSS score.
Official resources
-
CVE-2022-28810 CVE record
CVE.org
-
CVE-2022-28810 NVD detail
NVD
-
CISA Known Exploited Vulnerabilities catalog
CISA - Apply updates per vendor instructions.
-
Source item URL
cisa_kev
Publicly disclosed on 2023-03-07 in the supplied CVE metadata; CISA listed it in the KEV catalog on the same date with a remediation due date of 2023-03-28.