CVE-2022-47966 Explained: Zoho ManageEngine Unauthenticated RCE via SAML (CVSS 9.8)

Security Assertion Markup Language (SAML) is an XML-based authentication protocol used for single sign-on. When a user authenticates via a SAML Identity Provider (IdP), the IdP sends a signed XML assertion to the service provider (in this case ManageEngine). The service provider validates the XML signature to confirm the assertion is genuine.

Apache Santuario is the library ManageEngine used for XML digital signature validation. The vulnerability is an XML Signature Wrapping (XSW) attack — a class of attack where the attacker manipulates the structure of the XML document such that the signature validates a benign portion of the document while the application's business logic reads a different, attacker-controlled portion.

In practice: the attacker constructs a SAML response containing a legitimate signed element alongside a separate malicious element. The signature validation passes (it correctly validates the signed element), but ManageEngine's application code processes the attacker-controlled element instead — interpreting it as an authenticated admin assertion. The vulnerability exploited against ManageEngine allowed the SAML processing to trigger code execution, not merely authentication bypass.

The breadth of affected products makes CVE-2022-47966 unusual. A single vulnerable library in the SAML implementation meant that any ManageEngine product using that library for SAML was affected — spanning help desk, endpoint management, network management, firewall analysis, and privileged access management products. An organisation running multiple ManageEngine products had multiple simultaneously vulnerable entry points.

Secureworks documented exploitation campaigns consistent with APT41 (Double Dragon) — a prolific Chinese state-sponsored threat actor with a dual mandate of espionage and financial crime. APT41 has a documented history of targeting ManageEngine products, previously exploiting CVE-2021-40539 (ADSelfService Plus) and CVE-2022-35405 (Password Manager Pro). ManageEngine products are attractive APT targets because they hold credentials for a wide range of managed systems — compromising the management layer provides access to managed infrastructure.

Each affected ManageEngine product has a specific patched build number. Organisations running multiple ManageEngine products must patch each one individually.

CVE-2022-47966 is a supply-chain-of-libraries vulnerability: a single vulnerable version of Apache Santuario embedded across 24 products simultaneously created 24 independent pre-authentication RCE attack surfaces. The pattern is not unique to ManageEngine — any product suite sharing a vulnerable common component inherits the vulnerability across the entire suite.

The APT attraction to ManageEngine is straightforward: IT management software holds privileged access to the systems it manages. Compromising the management layer is compromising the managed infrastructure. For security teams, ManageEngine and similar IT management platforms should receive the same vulnerability prioritisation urgency as perimeter infrastructure — because from an attacker's perspective, they effectively are the perimeter.