# CVE-2022-36923: Zoho ManageEngine - Improper Access Control

> Live exploitation tracking for CVE-2022-36923 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-36923

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.4
- **Public exploit available:** Yes
- **Affected products:** Zoho ManageEngine
- **Weaknesses:** CWE-755 (Improper Handling of Exceptional Conditions); CWE-284 (Improper Access Control)
- **Tags:** enterprise_software

## Description

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

## CrowdSec analysis

[CVE-2022-36923](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-36923) is a vulnerability in several Zoho ManageEngine products that allows unauthenticated attackers to obtain users' API keys, potentially granting unauthorized access to external APIs. This flaw could be exploited to compromise sensitive data or perform actions on behalf of legitimate users, increasing the risk of data breaches and unauthorized system interactions.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

CrowdSec network observations suggest that most exploitation of CVE-2022-36923 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2022-36923 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit unauthenticated POST requests to the `/RestAPI/getAPIKey` endpoint with the `operation=getUserAPIKey` parameter to bypass authentication and retrieve user API keys.

## Timeline

- 2022-08-10: CVE Published. CVE-2022-36923 is published to NVD.
- 2026-01-07: Rule Released. CrowdSec releases a rule to detect CVE-2022-36923 exploitation attempts against the CrowdSec Network.
- 2026-01-14: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-36923 for the first time.

## References

- https://www.manageengine.com/itom/advisory/cve-2022-36923.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36923.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-36923) follows observed exploitation activity for CVE-2022-36923. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.