Security readout for executives and security teams
Plain-English summary
CVE-2023-35786 is a file disclosure flaw in Zoho ManageEngine ADManager Plus before build 7183. The available description says an administrative user can exploit an XML External Entity issue to view files. Business risk depends on who has admin access and what sensitive files the server can read.
Executive priority
Prioritize remediation where ADManager Plus manages sensitive identity workflows or is reachable by many administrators. This is not evidenced as actively exploited, but file disclosure from an identity management server can expose secrets or operational data.
Technical view
The reported weakness is XXE in ManageEngine ADManager Plus before 7183, reachable by admin users and resulting in file viewing. The source bundle provides no CVSS score, CWE, exploit details, or affected deployment context beyond the product/build statement.
Likely exposure
Organizations running ManageEngine ADManager Plus builds earlier than 7183 are the likely exposure group. Exposure is narrower than unauthenticated internet-facing bugs because the provided description requires admin privileges, but compromised or overprivileged admin accounts could increase impact.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Treat it as a privileged information-disclosure risk. Do not assume public exploitation or broader impact without vendor or threat-intelligence confirmation.
Researcher notes
Evidence is sparse: description, affected build threshold, and vendor reference are available, but no CVSS, CWE, exploit status, or detailed root-cause context is provided in the bundle. Validation should focus on build identification and vendor advisory confirmation.
Mitigation direction
- Upgrade ADManager Plus to build 7183 or later if applicable.
- Review ManageEngine’s advisory for current vendor guidance.
- Restrict ADManager Plus administrative access to approved staff only.
- Harden access paths with MFA, VPN, and least privilege.
- Review server file permissions for sensitive local files.
Validation and detection
- Inventory ADManager Plus instances and record exact build numbers.
- Flag any build below 7183 as affected.
- Confirm administrative accounts are current and authorized.
- Review logs for unusual admin activity around file access.
- Check the vendor advisory for updated remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-35786 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.