EUVD-2026-57740
GHSA-h4mg-pmfg-hhc5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable post-authentication SQL injection; low-privilege account sufficient; full CIA impact on credential database confirmed by vendor description.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
3DescriptionCVE.org
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
AnalysisAI
Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the ManageEngine Password Manager Pro or PAM360 web interface - the CVSS PR:L metric confirms that low-privilege (non-administrative) credentials are sufficient, meaning any standard user account grants the necessary access level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.8 with a High/High/High CIA impact triad accurately reflects the catastrophic potential of credential theft from a password vault. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ManageEngine Password Manager Pro to build 13232 or later and ManageEngine PAM360 to build 8552 or later as the primary remediation, per the vendor advisory at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-11840.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ManageEngine Password Manager Pro installations (before build 13232) and PAM360 deployments (before build 8552); verify exact build versions against vulnerability threshold; and immediately restrict network access to administrative IP ranges only, blocking all other authentication attempts to these systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today