Constellation · CASCA

Constellation explorer

Every signal has a story.Follow the evidence.

Return to triage

Find a CVE by identifier or text

↵ select

Minimum eligible CVSSOrderKEV only

Start with evidence

Current exploration

CVE-2022-47966

Your trail

Where next?

Selected cve

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.22

157 retained evidence references · snapshot-bound · open authoritative view

StateSource-scoped evidence

Priority84.5–99.5

Coverage85.0%

Connections23

Choose an action.

Evidence state

identity unresolved
known present
source constrained
evidence unknown

Snapshot-bound reason tuple

Last verified source snapshot retainedfactor_a_kev

The admitted source contract constrains coverage for this claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Review source contract

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-10-22T18:07:53.945Z
Resolution: Resolve identity

Connections 23

has cited scope1 retained · stored CVE-2022-47966 → n/a · n/a

803db2bd-589f-4876-9c50-6bbf40e9cebc

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_endpoint_dlp_plus

23904a44-2b8b-4b0c-9d19-14547d9d5179

has vulnerable target scope2 retained · stored CVE-2022-47966 → zohocorp · manageengine_servicedesk_plus_msp

1b7c750e-2675-4070-8c61-cbef1148e846574ccd6b-808a-4f28-8ac0-ab63f456c576

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_application_control_plus

f156b082-d29d-4666-b877-3c83113f67eb

has vulnerable target scope28 retained · stored CVE-2022-47966 → zohocorp · manageengine_admanager_plus

01770bb0-d5de-4f0e-9022-df30b846f8a612978eb7-8ab5-42be-ab5f-1557efbbcded2cc1c49f-56f7-44e8-bdf4-e0ba2b90fcde3b5374a6-438a-4b99-a502-d9441692ba3e3ed1c57d-6d1c-4806-93b5-5cc09b6539714470098d-fc73-4e23-8cfb-e1bf70affd64

has vulnerable target scope5 retained · stored CVE-2022-47966 → zohocorp · manageengine_pam360

0b267940-a3e6-4771-90f4-3fe47822c2211e07dc83-3632-4049-a600-c9e2de609d1660238938-bc9f-4fb5-b77d-bc7418857023879de1cd-15f4-43fc-8807-21b4b74553a19bdc4ea8-4ebf-4886-8cc6-688e1e4edacd

has vulnerable target scope5 retained · stored CVE-2022-47966 → zohocorp · manageengine_servicedesk_plus

0251ad6b-5ecc-4d49-b077-91dcc5c5fce11c604925-228a-4db7-8d85-5dd85c12fd673e44d982-e76e-4949-9f64-b23569aa1dae96938a32-ad07-4ad5-af33-b4a4e0785ff6c8a53f37-412a-4846-a646-9de955c81415

has vulnerable target scope9 retained · stored CVE-2022-47966 → zohocorp · manageengine_access_manager_plus

132f2c0f-8bbd-4ca8-8e02-76e49424b4f413f99f70-7382-44df-b4f1-19d15f50dc0a3edd6fad-20bd-4f1a-a07d-0c1b248e2f1844183c0c-ffdb-48d3-8603-7169112af3e34b1d7b83-0704-44d7-9782-3138465177818a611c78-c84f-4c3b-ba5d-a6122b41b3c7

has vulnerable target scope32 retained · stored CVE-2022-47966 → zohocorp · manageengine_assetexplorer

02622497-ca59-43ad-b0f8-169bb4e671010762f023-ce6a-4620-a669-a35349997e4107d0788b-c0d7-4759-91eb-737f0405eef21d7e185b-71a0-41b2-baa7-486fbad0e1d62608683f-2b7b-42c6-9b4e-f78a9b7040632893b816-558d-49b7-b484-2c872fdee62f

has vulnerable target scope9 retained · stored CVE-2022-47966 → zohocorp · manageengine_ad360

1d61d891-e9fd-4928-93ac-4e8d74084ece3c72a2a6-c9b9-4428-bdf0-92b6d3e7ce4c3f371d09-d65d-4555-a2bd-b5eb379b4b57567ff50c-b4fa-467b-8edc-ee0ff6e720cf86c29c0f-6e3c-4121-b568-190249fb60c699cdcd74-c1c4-4283-872e-9e36afd2dbbc

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_vulnerability_manager_plus

4b02389e-1df3-4928-b068-d8e27f17bcf1

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_remote_monitoring_and_management_central

c49f2132-1dee-4ad5-8f0a-e381ca72abf8

has vulnerable target scope2 retained · stored CVE-2022-47966 → zohocorp · manageengine_key_manager_plus

bb29e628-8822-4f1a-89d2-859e32338e16e822d44b-d225-4c42-864b-9c1f2ac19822

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_patch_manager_plus

7c5c1704-fbf0-4bc8-8705-f269184b985f

has vulnerable target scope20 retained · stored CVE-2022-47966 → zohocorp · manageengine_adaudit_plus

287cd628-43c3-4d05-96b9-b7f9e4b43877320f33c0-a20f-4e41-b1a4-59ac7169dee134138ade-4011-4eaa-abcd-27caefdd63744ad1225b-1b81-47c5-ad4c-9a17a9979e7b50bd4f24-1651-47a0-99be-43fdac4b0df2667dee52-5c1a-49ca-8df4-ef0e26f55e25

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_remote_access_plus

ccbbb374-e219-4442-b5cd-9e6b6b9d2ff1

has vulnerable target scope12 retained · stored CVE-2022-47966 → zohocorp · manageengine_adselfservice_plus

0229fa11-7f57-4ca0-94e1-56973b88c624056fe78b-8150-4159-94bc-378cc17e910f130f7721-b453-4162-9aac-302319a533da55a0798e-ddad-4e28-a63c-fc7c13f27c0a79c90bc1-69c4-45d2-8c57-8986eb4ef6249c1772bb-fb12-452f-be30-5b3be0d9b19b

has vulnerable target scope8 retained · stored CVE-2022-47966 → zohocorp · manageengine_password_manager_pro

0ebf3298-1bc5-44ba-837a-c5124c4a737a303dda65-804f-46f6-ad7d-2fd94aa3d9656ed70533-c307-40c0-b962-73368c04b3f7a89a53eb-8fb1-4700-84bc-eb2165b7fd17b772196b-cb4d-4f1d-8cf5-6471fc46c4b7d955dbd3-0a8a-4d8f-bb54-0c71cc565d63

has vulnerable target scope7 retained · stored CVE-2022-47966 → zohocorp · manageengine_analytics_plus

45156c13-3b6e-4473-b246-db872f3530544dc0d085-9ef8-4daa-9193-f165bc31b2e171d855b3-2eef-4995-a37a-eb331d7d7cfa76a6b070-4357-42f0-bc65-83217db21da4a44f00e0-9fea-467c-ba6f-61b950384612acd1ddbf-40fa-48fd-9685-ada47bbe2402

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_device_control_plus

1599201c-d4cf-4b51-b0b8-d166606b05d4

has vulnerable target scope8 retained · stored CVE-2022-47966 → zohocorp · manageengine_supportcenter_plus

096b9a35-c545-4170-927d-9585aac5bab41eca054c-b70f-4eee-b66a-6795a1220c83397a02e6-b481-487b-852e-c8dc85364d109e52be72-cb05-4190-8bff-d8e76e9a2a2be333c540-1673-4ea4-9bac-a2f4956f56caf151f5e7-c040-4aff-8d5e-a4ebe00eb961

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_browser_security_plus

00cf7c96-54af-4e17-ab69-63b07e59fe1c

has vulnerable target scope1 retained · stored CVE-2022-47966 → zohocorp · manageengine_os_deployer

24a47aa1-9e59-4b74-8342-b3e75d47a2f1

Focused snapshot evidence neighborhood.

CVEProductSignalSelected / traceVisual proximity carries zero evidence weight.

Data as of

Evidence current through Oct 22, 2026, 6:07 PM UTC · 24 entities · 23 relationships · bounded complete