CVE-2023-26601

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 34.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-06 · updated 2026-06-17
Weakness: CWE-400

Description

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

Affected products

Manage Engine Asset Explorer Agent: before 6.9; 6.9, 6.9-6900, 6.9-6901, 6.9-6902, 6.9-6903, 6.9-6904 (+31) — fixed in 6.9
ManageEngine ServiceDesk Plus: before 14.1; 14.1, 14.1-14100, 14.1-14101, 14.1-14102, 14.1-14103 — fixed in 14.1
Zohocorp Manageengine Servicedesk Plus Msp: before 14.0; 14.0-14000 — fixed in 14.0
Zohocorp Manageengine Supportcenter Plus: before 14.0; 14.0-14000 — fixed in 14.0

How to fix

Upgrade to a fixed version: Manage Engine Asset Explorer Agent 6.9; ManageEngine ServiceDesk Plus 14.1; Zohocorp Manageengine Servicedesk Plus Msp 14.0; Zohocorp Manageengine Supportcenter Plus 14.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26601 or the next vulnerability affects your stack