# Architecture - Vulnerability Manager Plus LAN

**Last Updated On**: 17 Jul 2026  
**4 minutes read**

ManageEngine Vulnerability Manager Plus is an Enterprise [vulnerability management software](https://www.manageengine.com/vulnerability-management/index.html) that helps you scan, assess, prioritize, and remediate vulnerabilities in your network endpoints. It comprises features like [vulnerability scanning](https://www.manageengine.com/vulnerability-management/vulnerability-scanner.html), [vulnerability assessment](https://www.manageengine.com/vulnerability-management/vulnerability-assessment.html), automated patch management, [CIS compliance](https://www.manageengine.com/vulnerability-management/cis-compliance.html), [security configuration management](https://www.manageengine.com/vulnerability-management/security-configuration-management.html), [zero-day vulnerability mitigation](https://www.manageengine.com/vulnerability-management/zero-day-vulnerability-mitigation.html), high-risk software audit, and web server hardening.

The following guide will help you understand the process of [vulnerability management](https://www.manageengine.com/vulnerability-management/what-is-vulnerability-management.html) with the help of an architecture diagram.

![vulnerability-management-architecture](https://cdn.manageengine.com/sites/meweb/images/vulnerability-management/help/images/architecture1.webp)

## Security Research Team

The **Security Research Team** at Zoho Corp. plays a vital role in maintaining cybersecurity. They continuously probe the internet to:

- Obtain vulnerability information along with its CVE ID, CVSS scores, severity, details on exploit code, and patches.
- Download Microsoft, Apple, Linux, and other third-party patches from respective vendor sites.
- Derive security configurations for systems and hardening guidelines for servers from widely trusted benchmarks such as CIS and STIG.
- Obtain information on software such as End-of-Life, Remote Desktop sharing, and Peer-to-Peer software that are deemed unsafe by itself.

The authenticity and functional correctness of the patches are then tested and correlated with the corresponding vulnerability they address.

### Central Database

The Central Vulnerability Database hosted at the Zoho Corp. site gets updated periodically with the latest details of:

- Known and emerging vulnerabilities
- Latest patches released by Microsoft, Apple, Linux, and other third-party vendors
- Security configuration baselines and remediation content
- Web server hardening content
- High-risk software list
- New compliance policies and changes related to existing policies

The Central Vulnerability Database is a portal in the Zoho Corp. site that is constantly updated with the latest information and serves as the baseline for vulnerability management in the customer organization.

## At Customer Site

IT administrators or network security teams need the following components to perform vulnerability management in the enterprise:

1. [Vulnerability Manager Plus Server](#vulnerability-manager-plus-server)
2. [Agents](#agents)
3. [Network Devices](#network-devices)
4. [Web Console](#web-console)

### Vulnerability Manager Plus Server

The Vulnerability Manager Plus Server helps you centrally perform all vulnerability management and compliance tasks in your network endpoints. Some of the tasks include:

- Installing agents in computers
- Scanning computers for vulnerabilities and misconfigurations
- Deploying patches and secure configurations
- Uninstalling high-risk software
- Auditing active ports
- Auditing for compliance against CIS benchmarks

Any Windows computer in your network with the requirements mentioned [here](https://www.manageengine.com/vulnerability-management/vulnerability-management/system-requirements.html) can be hosted as your Vulnerability Manager Plus Server.

The Vulnerability Manager Plus Server at the customer site subscribes to the Central Vulnerability Database, from which it synchronizes the latest information on threats, patches, vulnerabilities, and compliance policies. Patches are downloaded directly from vendor sites and stored centrally in the server's patch store and replicated to your network endpoints to conserve bandwidth.

## Ports Utilized for Vulnerability Management

| Port | Purpose | Type | Connection |
|---|---|---|---|
| 8020 | Agent/Distribution Server to VMP Server | HTTP | Inbound to server |
| 8383 | Agent/Distribution Server to VMP Server | HTTPS | Inbound to server |
| 8027 | Agent Server communication | TCP | Inbound to server |

## Ports Utilized for Network Devices

| Port | Purpose | Type | Connection |
|---|---|---|---|
| 161 | VMP Server to Network Device (SNMP) | TCP | Inbound to Network Device |
| 22 | VMP Server to Network Device (SSH) | TCP | Inbound to Network Device |

## Distribution Server

| Port | Purpose | Type | Connection |
|---|---|---|---|
| 8384 | Agent to Distribution Server | HTTPS | Inbound to Distribution Server |
| 8021 | Agent to Distribution Server | HTTP | Inbound to Distribution Server |

### Agents

To perform vulnerability scanning and management, a lightweight agent is installed by the server in your managed endpoints. The agent contacts the server every 90 minutes to get the data required to carry out the tasks delegated by the server. It returns the results to the server after task completion. The agent also maintains a continuous thin connection with the server to perform on-demand tasks.

### Network Devices

After server installation, network devices can be discovered and added from the server console. Once the vulnerability database sync is complete, agentless scanning of credential-mapped network devices is performed, enabling the detection of firmware vulnerabilities in network devices.

### Web Console

The web console is a graphical user interface to access the server and perform vulnerability management tasks. It empowers users with a single pane view to perform all vulnerability management tasks from anywhere, anytime.