ManageEngine Password Manager Pro CVE-2026-11840

Exploitation requires a valid authenticated session on the ManageEngine Password Manager Pro or PAM360 web interface - the CVSS PR:L metric confirms that low-privilege (non-administrative) credentials are sufficient, meaning any standard user account grants the necessary access level. No special configuration, non-default feature toggle, or specific deployment mode is documented as a prerequisite beyond having an active login. Exploitation is not limited to administrators, which expands the threat surface to all user accounts provisioned on the platform. Limiting factors include: the attacker must possess valid credentials for the target PAM instance (reducing pure external threat actor risk unless credentials are obtained via phishing or a prior breach), and network access to the management interface is required (AV:N), so environments that restrict PAM web access to VPN or jump-host networks reduce exposure meaningfully.

The CVSS base score of 8.8 with a High/High/High CIA impact triad accurately reflects the catastrophic potential of credential theft from a password vault. The network attack vector (AV:N), low complexity (AC:L), and absence of user interaction (UI:N) mean that any authenticated session - even a read-only user account - is sufficient to trigger exploitation, which lowers the effective barrier significantly in environments with broad user access to the platform. The scope is unchanged (S:U), meaning the SQL injection is contained to the application's database context, but in a PAM product that context IS the crown jewel. No EPSS data was provided in the source intelligence; however, given the product sensitivity and Zoho ManageEngine's historical targeting by threat actors, even a mid-sized IT department in radom should treat this as urgent and not rely on low-exploitation-probability assumptions. KEV status is not confirmed - no CISA KEV entry is reflected in the available data - and no public POC has been identified, which somewhat moderates immediate mass-exploitation risk, but the authenticated-only barrier is a thin one in enterprise environments where many users hold credentials to PAM platforms.

An attacker with a low-privilege authenticated account on a ManageEngine Password Manager Pro or PAM360 instance - such as a shared service account or a compromised help-desk user - submits a crafted HTTP request to a vulnerable endpoint, injecting malicious SQL syntax into a query parameter. The injected payload causes the backend database to return or modify credential records, potentially dumping the entire vault of managed passwords, SSH keys, and privileged account credentials in one operation. No public proof-of-concept has been identified at the time of analysis, but the low complexity and well-understood nature of SQL injection make independent exploitation development straightforward for a skilled attacker.