CVE-2014-7866
HighPublic exploitMultiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a ..
Published Dec 10, 2014 · Updated May 6, 2026
Key Facts
Patch immediately- CVE-2014-7866 is a high-severity vulnerability (CVSS 7.5 v2) affecting Manageengine It360 (Zohocorp), Manageengine Opmanager (Zohocorp), Manageengine Social It Plus (Zohocorp).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 80% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
80%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2014-7866 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.
Affected Products
16 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Manageengine It360Zohocorp | 10.3.0, 10.4 | n/a |
| Manageengine OpmanagerZohocorp | 10.0, 10.1, 10.2, 11.0, 11.1, 11.2, 11.3, 11.4 | n/a |
| Manageengine Social It PlusZohocorp | 11.0 | n/a |
Timeline
Publicly disclosed
Dec 10, 2014
Last updated
May 6, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- exploit20141109 [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360
- exploithttps://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- exploithttps://support.zoho.com/portal/manageengine/helpcenter/articles/fix-for-remote-code-execution-via-file-upload-vulnerability
- exploitExploitDB-35209
- exploitExploitDB-43896
FAQ
Common Questions.
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a ..
Affected: Manageengine It360 (Zohocorp) versions 10.3.0, 10.4; Manageengine Opmanager (Zohocorp) versions 10.0, 10.1, 10.2, 11.0, 11.1, 11.2, 11.3, 11.4; Manageengine Social It Plus (Zohocorp) versions 11.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2014-7866 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo