CVE-2022-47966: Researchers to Release PoC Exploit for Critical Vulnerability Affecting ManageEngine Products

Later this week, Horizon3 researchers plan to release a Proof of Concept (PoC) exploit for CVE-2022-47966, a critical unauthenticated, remote code execution vulnerability in multiple ManageEngine products. 

ManageEngine On-Demand/cloud products are not affected by this vulnerability.

Note: CVE-2022-47966 is dependent on the specific ManageEngine product. Some products are vulnerable if SAML single-sign-on is enabled OR has ever been enabled, while others require SAML single-sign-on to be currently enabled. 

We assess it is highly likely threat actors will leverage the PoC exploit to exploit vulnerable ManageEngine products that are exposed to the Internet due to the ease of exploitation and privileges obtained after successful exploitation. Notably, threat actors have leveraged at least three ManageEngine RCE vulnerabilities in prior intrusions.  

Impacted Products 

Recommendation for CVE-2022-47966

Apply the Available Updates from ManageEngine 

We strongly recommend applying the available updates from ManageEngine to prevent potential exploitation. We expect threat actors to begin leveraging the vulnerability in the near-term to obtain initial access into victim environments.  

Fixed versions are provided above and can also be found here.   

References 

• Horizon3 PoC Announcement 
• ManageEngine Security Advisory
• Horizon3 Technical Summary