Security researchers at Rapid7 have published a blog post warning that they have observed the active exploitation of a critical vulnerability affecting specific ManageEngine on-premise products by Zoho. ManageEngine is an IT service management solution used by hundreds of companies for monitoring and managing all of the hardware and software devices on their networks. The flaw, tracked as CVE-2022-47966, is a pre-authentication remote code execution (RCE) vulnerability stemming from a vulnerable third-party dependency on Apache Santuario for XML signature validation. Specifically, the flaw is exploitable if a user has enabled Security Assertion Markup Language (SAML) single-sign-on, authorizing access to multiple web applications with a single credential set. Attackers could exploit this vulnerability by issuing an HTTP POST request that contains a maliciously crafted SAML response, allowing for RCE. If successfully exploited, an attacker could take complete control of the system that a vulnerable ManageEngine project is running on, steal credentials, deploy malware, and pivot laterally across the network. This product is very popular, being utilized by nine (9) out of every ten (10) Fortune 100 companies, making these vulnerable organizations a very lucrative target for threat actors. Researchers from Horizon3.ai have published a working proof-of-concept (PoC) for exploiting this vulnerability and state that the attack is easy to exploit, making it even more likely that there will be exploitation attempts by sophisticated nation state hackers, financially motivated threat groups, and unsophisticated attackers with limited skills. This vulnerability was patched in October and November of 2022, and CTIX analysts recommend that organizations leveraging any of the products listed in ManageEngine’s security advisory upgrade their infrastructure immediately to prevent exploitation attempts.