CVE-2025-10020

published 2025-10-21

CVE-2025-10020: Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

Priority P2 66 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_admanager_plus	< 8024	8024
zohocorp	manageengine_admanager_plus	< 8.0	8.0
zohocorp	manageengine_admanager_plus	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2025-10020 is an authenticated command injection vulnerability located in the Custom Script component of ManageEngine ADManager Plus. Monitor for suspicious process spawning or shell execution originating from the ADManager Plus service process, particularly in the Custom Script execution path. ↗

• · Exploitation requires authentication; the attack surface is limited to authenticated users with access to the Custom Script component. Restrict access to this component to trusted administrators only. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77