CVE-2025-10020

HighCVSS 8.5

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.54%

91th percentile - higher than 91% of all known CVEs

Summary

Zohocorp ManageEngine ADManager Plus before version 8024 is vulnerable to authenticated command injection in the Custom Script component.

Risk Assessment

An authenticated attacker can execute arbitrary commands on the server, potentially leading to full system compromise.

Recommendation

Upgrade to version 8024 or later, which contains the fix.

Other vulnerabilities in ManageEngine ADManager Plus

CVE-2025-11670Medium
Zohocorp ManageEngine ADManager Plus before version 8025 is vulnerable to NTLM Hash Exposure. This is exploitable only by technicians with the "Impersonate as Admin" option enabled.

Original NVD description (English source)

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS