What is CVE-2023-26601?

CVE-2023-26601 is a high-severity vulnerability in Zohocorp Manageengine Assetexplorer, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2023-03-06.

How severe is CVE-2023-26601?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Zohocorp Manageengine Assetexplorer

CVE-2023-26601

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

Vulnerability class: DoS (Denial of Service)

Published 2023-03-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.341 (98.4th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.341 · newest: 0.341 · change: 0.000

Affected products

Zohocorp Manageengine Assetexplorer — versions 6.9
Zohocorp Manageengine Servicedesk Plus — versions 14.1
Zohocorp Manageengine Servicedesk Plus Msp — versions 14.0
Zohocorp Manageengine Supportcenter Plus — versions 14.0

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

manageengine.com (Product)
www.manageengine.com/products/service-desk/CVE-2023-26601.html (Vendor Advisory)

Frequently asked questions

What is CVE-2023-26601?: CVE-2023-26601 is a high-severity vulnerability in Zohocorp Manageengine Assetexplorer, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2023-03-06.
How severe is CVE-2023-26601?: High severity. CVSS v3 base score is 7.5 out of 10.