CVE-2023-31099
Zohocorp Manageengine Opmanager ≤ 12.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-31099 is a high-severity an unspecified weakness vulnerability in Zohocorp Manageengine Opmanager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Zoho ManageEngine OPManager through version 126323 contains a remote code execution vulnerability that can be triggered through its probe servers. The flaw carries a CVSS 3.1 score of 8.8 and is reachable over the network by any authenticated user without additional user interaction.
An authenticated attacker can leverage the issue to execute arbitrary code on the affected server, resulting in full compromise of confidentiality, integrity, and availability. No special privileges beyond standard authenticated access are required.
Official guidance is available from the vendor at https://www.manageengine.com/network-monitoring/security-updates/cve-2023-31099.html, which directs customers to apply the listed security updates for OPManager.
EPSS for the CVE reached a peak of 0.8494 on 2026-04-16 before receding to the current value of 0.5823, indicating sustained post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35427
Vulnerability Data
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.