Loading story…
Attackers exploited CVE-2022-47966, a pre-authentication remote code execution vulnerability affecting at least 24 on-premises ManageEngine products, to compromise servers and establish persistent access. The flaw stems from Apache Santuario and is exploitable under product-specific SAML single sign-on configuration conditions. ManageEngine released patches in October and November 2022, but Rapid7 observed exploitation beginning January 17, 2023—two days before Horizon3 published proof-of-concept code and a technical analysis.
Observed attacks deployed webshells, established persistent tunnels, created privileged accounts, weakened credential protections, and disabled security controls. Additional exploitation involved Agent Tesla download activity, Monero mining, and PowerShell reverse shells. Organizations operating affected products should apply the appropriate vendor updates and assess exposure against ManageEngine’s product-specific SAML conditions. Previously unpatched systems warrant investigation using documented logs, process behavior, and network indicators; patching alone does not remove attacker-created accounts, webshells, or other persistence mechanisms.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
Rapid7 released remote vulnerability checks for SupportCenter Plus, Key Manager Plus, Asset Explorer, Access Manager Plus, PAM 360, and Password Manager Pro.
Rapid7 released remote vulnerability checks for CVE-2022-47966 in ServiceDesk Plus and ADSelfService Plus.
Horizon3 released technical information and public proof-of-concept exploit code for CVE-2022-47966, which affects at least 24 on-premise ManageEngine products.
Rapid7 observed exploitation across organizations as early as January 17, 2023, UTC. The attacks preceded the release of public proof-of-concept exploit code.
ManageEngine released additional fixes for CVE-2022-47966 in November 2022, with fixed-version release dates varying by product.
ManageEngine released patches for affected products in October 2022. The vulnerability permits pre-authentication remote code execution through a vulnerable Apache Santuario dependency under product-specific SAML single sign-on conditions.
Rapid7 created a Velociraptor artifact to hunt for the observed exploitation activity on ManageEngine assets.
Rapid7 observed a PowerShell reverse shell connecting to 45[.]61.136.188 on TCP port 443 during exploitation activity.
Rapid7 observed Monero coinminer installation through a batch script downloaded from http://50[.]19.48.59:82/me.bat.
Rapid7 observed execution of an Agent Tesla-related download cradle from 163[.]123.142.210/bypass.ps1 during exploitation activity.
Rapid7 observed additional exploitation through ManageEngine-spawned processes without webshell creation, including disabling Microsoft Defender protections and launching enc.exe. Observed activity also included a Chisel reverse SOCKS tunnel, creation of a privileged superadmin account, and enabling RDP and its firewall rules.
In the first exploitation instance described by Rapid7, an attacker used a malicious SAML XML payload to install commons.jsp, execute commands as SYSTEM, and enumerate the environment. The attacker established a Plink reverse tunnel for RDP, elevated the guest account, changed account passwords, and enabled plaintext credential storage through WDigest.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
rapid7.com
Open sourcemanageengine.com
Open sourcehorizon3.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2019-8394** in Zoho ManageEngine ServiceDesk Plus to upload web shells and compromise networks despite a patch released in early 2019, according to SOC Prime’s December 2020 report. The vulnerability affects versions before **10.0 build 10012** and involves insufficient sanitization of user-supplied input in crafted SMTP requests. Exploitation requires authentication but can be performed with minimal privileges, including guest credentials, enabling arbitrary system command execution. Web shells can give attackers persistent access to affected servers and support further network compromise. Organizations running vulnerable builds should upgrade to a patched version and investigate exposed systems for unauthorized web shells; patching alone does not remove an existing compromise. SOC Prime also pointed defenders to NSA and Australian Signals Directorate guidance on detecting and preventing web shell malware, providing complementary measures for identifying malicious server-side files and reducing opportunities for persistent access.
Oct 9, 2026
Attackers are exploiting critical unauthenticated remote code execution vulnerabilities **CVE-2026-1281 and CVE-2026-1340** in Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core. Both flaws carry CVSS scores of 9.8 and stem from unsafe handling of attacker-controlled input in Bash scripts invoked through Apache RewriteMap. Telekom Security responders observed command-execution checks, JSP webshell deployment, reverse-shell attempts, secondary malware delivery, and database export attempts across multiple customer environments. CrowdSec reported exploitation-related activity increasing in early February and a small number of attackers targeting more than 500 distinct machines, without establishing how many were compromised; CVE-2026-1281 was also added to CISA’s Known Exploited Vulnerabilities catalog. Public reporting indicates exploitation across multiple countries and sectors, while Germany’s BSI warned that attacks may have begun as early as summer 2025, before the flaws’ January 2026 disclosure. **Patching alone does not remove previously established persistence.** Organizations should apply current Ivanti patches, verify that RPM-based mitigations persist after reboots, restrict appliance access through a VPN, and assess systems using published detection guidance. Response teams should investigate webshells and other persistence, possible credential theft, data exfiltration, and lateral movement, and follow vendor guidance on upgrading to EPMM 12.8.0.0.
Oct 9, 2026
**Ivanti Endpoint Manager Mobile (EPMM)** is being actively exploited via two critical, unauthenticated remote code execution vulnerabilities, **CVE-2026-1281** and **CVE-2026-1340** (both reported as CVSS 9.8). Reporting describes attackers achieving full control of exposed EPMM/MDM infrastructure, including establishing reverse shells, deploying web shells, performing reconnaissance, and downloading additional malware; activity has been observed across multiple countries and sectors (including government, healthcare, manufacturing, and technology). **CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities (KEV) Catalog**, and defenders are urged to apply Ivanti’s available fixes/updates per the vendor advisory. Telemetry and threat-intel observations indicate broad internet exposure and automation in exploitation. Unit 42 reported visibility into **4,400+** EPMM instances, and noted threat actors shifting from initial exploitation toward **dormant backdoors** intended to preserve access even after patching. GreyNoise data highlighted that a large share of observed exploitation traffic (reported as **83%**) originated from a single IP, `193.24.123.42`, associated with “bulletproof” hosting, with attackers rotating user-agent strings consistent with mass scanning/exploitation; the same infrastructure was also linked to attempts against other products (e.g., Oracle WebLogic, `telnetd`, and GLPI).
Jun 29, 2026