ManageEngine OpManager - RCE (CVE-2020-28653)
Description
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
psychologyCrowdSec Analysis
CVE-2020-28653 is a critical remote code execution vulnerability in Zoho ManageEngine OpManager versions prior to Stable build 125203 and Released build 125233, exploitable via the Smart Update Manager (SUM) servlet. Attackers can leverage this flaw to execute arbitrary code on the affected server without authentication, potentially leading to full system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2020-28653 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the vulnerable SUM servlets by sending crafted POST requests to endpoints such as /servlets/com.adventnet.tools.sum.transport.SUMCommunicationServlet and /servlets/com.adventnet.tools.sum.transport.SUMHandShakeServlet to trigger Java deserialization and achieve remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-02-03 |
| Rule Released | 2025-10-15 |
| CrowdSec First Seen | 2025-10-28 |
Remediation & Protection
External References
- http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html
- https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125203
- https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125233
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28653.yaml