Authenticated Command Injection Vulnerability in Zoho ManageEngine ADManager Plus
CVE-2025-10020

9.9CRITICAL

Key Information:

Vendor

Zohocorp
Status
Manageengine Admanager Plus
Vendor
CVE Published:
21 October 2025

What is CVE-2025-10020?

Zoho Corporation's ManageEngine ADManager Plus, specifically versions prior to 8024, is subject to an authenticated command injection vulnerability within the Custom Script component. This may allow an attacker with valid credentials to execute arbitrary commands on the underlying system, leading to potential unauthorized access and exploitation of sensitive information.

Affected Version(s)

ManageEngine ADManager Plus 0 < 8024

References

https://www.manageengine.com/products/ad-manager/admanage...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-10020 : Authenticated Command Injection Vulnerability in Zoho ManageEngine ADManager Plus