ManageEngine OpManager - RCE (CVE-2020-28653)

CVE-2020-28653 is a critical remote code execution vulnerability in Zoho ManageEngine OpManager versions prior to Stable build 125203 and Released build 125233, exploitable via the Smart Update Manager (SUM) servlet. Attackers can leverage this flaw to execute arbitrary code on the affected server without authentication, potentially leading to full system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2020-28653 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2020-28653 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the vulnerable SUM servlets by sending crafted POST requests to endpoints such as /servlets/com.adventnet.tools.sum.transport.SUMCommunicationServlet and /servlets/com.adventnet.tools.sum.transport.SUMHandShakeServlet to trigger Java deserialization and achieve remote code execution.