CVE-2025-9223

Command Injection

State: Published
Severity: 8.8 High
Published: Nov 11, 2025
Updated: Feb 26, 2026
Reserved: Aug 20, 2025

Description

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Zohocorp

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
ManageEngine Applications ManagerZohocorp	before 178200Affected

References

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-9223.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.