CVE-2019-11469

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid...

9.8 CriticalPublic exploit

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

17.0%Up 11.6 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2019-11469
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-11469
Updated: 2026-11-02

EUVDEUVD-2019-3142 No score

Record: EUVD-2019-3142
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9g5v-572f-c456 No score

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid...

Record: GHSA-9g5v-572f-c456
Updated: 2026-11-02

Affected products

zohocorp manageengine applications manager

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	ManageEngine Applications Manager 14.0 - Authentication Bypass / Remote Command Execution (Metasploit)	2019-04-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11469 is a critical vulnerability (CVSS 9.8) in Zohocorp Manageengine Applications Manager, published April 23, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.0%, the 97th percentile. No source names a fixed version.