PT-2024-36395 · Zoho · Zoho Manageengine Opmanager+1

Daniel Santos · Published 2024-08-23 · Updated 2026-05-17 · CVE-2024-5466

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below

Description The issue concerns an authenticated remote code execution vulnerability in the deploy agent option. This allows for potential exploitation, but specific details about real-world incidents or the estimated number of affected devices are not provided.

Recommendations For versions 128329 and below, consider disabling the deploy agent option as a temporary workaround until a patch is available. Restrict access to the deploy agent functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-5466

Affected Products

Remote Monitoring/Management

Zoho Manageengine Opmanager

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-5466 · Security Note
• https://manageengine.com/itom/advisory/cve-2024-5466.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5466 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1827033994895995027 · Twitter Post
• https://t.me/cvedetector/3987 · Telegram Post
• https://twitter.com/cracbot/status/1828311606666895603 · Twitter Post
• https://t.me/true_secator/6131 · Telegram Post
• https://twitter.com/threatcluster/status/2055868489081016372 · Twitter Post
• https://twitter.com/CVEnew/status/1826976906962444521 · Twitter Post
• https://twitter.com/cracbot/status/1828673933161210211 · Twitter Post
• https://t.me/cvenotify/92298 · Telegram Post
• https://twitter.com/CveFindCom/status/1826990707317289130 · Twitter Post