CVE-2022-26653

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777Exploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/advisory/cve-2022-26653.htmlVendor Advisory
https://raxis.com/blog/cve-2022-26653-and-cve-2022-26777Exploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/advisory/cve-2022-26653.htmlVendor Advisory

Timeline

Published: Apr 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-266547.5Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.CVE-2022-266557.5Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gate CVE-2022-266568.2Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.CVE-2022-266577.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-266597.1Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a CVE-2022-26669.8A vulnerability has been found in SourceCodester Loan Management System and classified as critical. This vulnerability affects unknown code CVE-2022-266607.5RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the cre CVE-2022-266616.5An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.CVE-2022-266627.5An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x CVE-2022-266657.5An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to ac CVE-2022-266669.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allo CVE-2022-266679.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData