CVE-2025-9223 in Applications Manager
Summary
by MITRE • 11/11/2025
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified as CVE-2025-9223 affects Zohocorp ManageEngine Applications Manager versions 178100 and earlier, presenting a critical authenticated command injection flaw within the execute program action feature. This vulnerability stems from improper configuration handling that allows authenticated attackers to execute arbitrary commands on the underlying system. The flaw specifically manifests in how the application processes user inputs within the execute program action functionality, creating a pathway for malicious command execution that bypasses normal security controls.
The technical implementation of this vulnerability falls under CWE-78, which describes improper neutralization of special elements used in OS commands, and aligns with ATT&CK technique T1059.001 for command and script injection. Attackers with valid credentials can leverage this weakness to inject malicious commands that get executed with the privileges of the application process. The vulnerability is particularly concerning because it requires only authentication, eliminating the need for additional reconnaissance or exploitation prerequisites. The execute program action feature likely processes user-provided parameters without adequate sanitization or validation, allowing attackers to append malicious commands that get interpreted and executed by the underlying operating system.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it can enable attackers to gain full system control, extract sensitive data, modify configurations, or establish persistent access points. Organizations using affected versions face significant risk of data breaches, system compromise, and potential lateral movement within their network infrastructure. The vulnerability affects the core functionality of the Applications Manager platform, which typically monitors and manages enterprise applications, making it a high-value target for attackers seeking to disrupt business operations or gain access to critical infrastructure monitoring systems. This weakness can be exploited to execute system commands that may include file manipulation, network scanning, or even privilege escalation to system administrator levels.
Mitigation strategies should focus on immediate patching of affected systems to the latest available versions that address this command injection vulnerability. Organizations should implement strict input validation and sanitization for all user-provided parameters within the execute program action feature. Network segmentation and privilege separation can help limit the impact if exploitation occurs, while monitoring for unusual command execution patterns can aid in detecting potential exploitation attempts. The principle of least privilege should be enforced for accounts with access to the execute program action feature, and regular security assessments should verify that no other similar vulnerabilities exist within the application's codebase. Additionally, implementing web application firewalls and intrusion detection systems can provide additional layers of protection against exploitation attempts targeting this specific vulnerability.