CVEvulnerability

CVE-2022-35405

9.8 CRITICAL Known exploited Published 2022-07-19 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability — Zoho ManageEngine

Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

Added to KEV: 2022-09-22
Remediation due: 2022-10-13
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html; https://nvd.nist.gov/vuln/detail/CVE-2022-35405

Status: Analyzed
Published: 2022-07-19
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-502

Description

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected configurations

• zohocorp manageengine access manager plus (< 4.3) • zohocorp manageengine access manager plus 4.3 • zohocorp manageengine pam360 (< 5.5) • zohocorp manageengine pam360 5.5 • zohocorp manageengine password manager pro (< 12.1) • zohocorp manageengine password manager pro 12.1

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References