VulnerabilityPublished 1 Mar 2022Updated 30 May 2025

CVE-2022-24446: Zoho ManageEngine Key Manager Plus

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Mar 2022
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected =6.1.6	Fixed in–

AI-suggested

Immediate review and restriction of Operator role assignments: Limit the number of users assigned the Operator role and ensure that only fully trusted personnel hold this role.
Implement strict network segmentation and monitoring around Key Manager Plus servers to detect unusual access patterns or data exfiltration attempts.
Employ compensating controls such as additional authentication layers (e.g., multi-factor authentication) for accessing the Key Manager Plus console.
Regularly audit and monitor logs for unauthorized access or attempts to view SSH server and user information beyond assigned privileges.
6. Consider deploying external privileged access management or vaulting solutions to reduce reliance on a single tool with known vulnerabilities. 7. Educate operators and administrators about the risks of privilege escalation and the importance of adhering to least privilege principles. 8. Isolate the Key Manager Plus management interface from general user networks to reduce exposure. These steps go beyond generic advice by focusing on role management, monitoring, and compensating controls tailored to the specific nature of this vulnerability.

Description

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.

Impact

For European organizations, this vulnerability poses a significant risk to the confidentiality of critical infrastructure credentials and system information. Many enterprises and public sector entities in Europe rely on ManageEngine Key Manager Plus to manage privileged access securely. Unauthorized visibility into all SSH servers and user accounts can facilitate targeted attacks, including credential theft, lateral movement, and eventual compromise of sensitive systems. This is particularly concerning for sectors with stringent regulatory requirements such as finance, healthcare, and government, where unauthorized access to privileged credentials can lead to data breaches, operational disruption, and compliance violations under GDPR and other regulations. The exposure of SSH server and user details could also aid threat actors in crafting sophisticated phishing or social engineering campaigns. Although the vulnerability does not directly enable remote code execution or system takeover, the information disclosure significantly weakens the security posture and increases the attack surface. Organizations with large, distributed IT environments or those employing multiple operators with limited privileges are especially at risk, as the flaw effectively nullifies role-based access restrictions. The absence of a patch or fix at the time of disclosure further elevates the urgency for European organizations to implement alternative security measures to mitigate potential exploitation.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2025, 15:40 UTC

Technical details

References

Community reviews

Related threats