Critical RCE Vulnerability in ManageEngine Applications Manager Exploited

• •CVE-2020-14008 allows remote code execution in ManageEngine Applications Manager.
• •New exploit improves reliability over previous methods, bypassing upload failures.
• •Default admin credentials increase vulnerability risk for many deployments.

A new exploit for CVE-2020-14008 has been released, targeting ManageEngine Applications Manager versions up to 14720. This vulnerability allows remote code execution via an authenticated command-execution primitive, enabling attackers to run arbitrary commands as the system account. The exploit bypasses the original proof-of-concept's fragile upload chain, improving reliability in real-world scenarios. It leverages PowerShell to fetch a payload from an attacker-controlled HTTP server. The exploit is parameterized for flexibility in targeting and callback configurations. Default credentials are often left unchanged, increasing the risk of exploitation. The exploit is available publicly, and security professionals are urged to assess their systems for vulnerability. Current status indicates that exploitation is possible, but no active exploitation in the wild has been confirmed yet.