CVE-2018-16364

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-26 · updated 2026-06-17
Weakness: CWE-502

Description

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

Affected products

Zohocorp ManageEngine Applications Manager: 13.7, 13.7-build13700, 13.7-build13710, 13.7-build13720, 13.7-build13730, 13.7-build13750 (+4)

References

https://blog.jamesotten.com/post/applications-manager-rce/
https://blog.jamesotten.com/post/applications-manager-rce/

Get alerted when CVE-2018-16364 or the next vulnerability affects your stack