CVE-2022-47966

CVE-2022-47966 is a critical remote code execution (RCE) vulnerability affecting numerous Zoho ManageEngine on-premise products, including ServiceDesk Plus, ADManager Plus, and Endpoint Central, stemming from insecure handling of XSLT features in an outdated Apache Santuario xmlsec library. This flaw allows unauthenticated attackers to execute arbitrary code if SAML SSO has ever been configured for the product. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, including by nation-state threat actors and ransomware campaigns, with public Metasploit modules and Nuclei templates available, and has garnered significant community discussion and media coverage.