Threat Source newsletter (March 19, 2020)

Summary: Cisco Talos reported that attackers are exploiting a remote code execution vulnerability in Zoho ManageEngine, tracked as CVE-2020-10189, which allows deserializing data and executing arbitrary code with SYSTEM or root privileges. One security researcher found 2,300 unprotected instances running ManageEngine, and Talos issued Snort SIDs 53433 through 53435 for detection.
Bottom line: A single researcher counted 2,300 unprotected ManageEngine instances, and exploitation of this bug hands an attacker SYSTEM or root on the host - the highest level of access a defender has to lose.

Read the original at Cisco Talos ↗

Topics: Detection & Response
Mentions: CVE-2020-10189
Related: CVE-2020-10189: Zoho Manage Engine Desktop Central File Upload Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026