Password Manager Pro CVE-2026-12263

SAML SSO must be configured and actively enabled within the ManageEngine Password Manager Pro or PAM360 instance - this is not a default-on feature and requires administrative setup against an external Identity Provider. The attacker must possess at minimum a low-privilege account (PR:L per vendor CVSS vector), which could take the form of a valid IdP-federated user, a local low-privilege application account capable of initiating the SAML flow, or any other identity that can reach the SAML authentication endpoint. Exploitation is limited to network-reachable instances (AV:N); no user interaction is required (UI:N). Instances running solely on local authentication without SAML SSO enabled are not vulnerable to this specific flaw. The vulnerability is bounded to Password Manager Pro versions below 13232 and PAM360 versions below 8551.

The vendor-assigned CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, low-complexity, network-exploitable flaw. The PR:L requirement - a low-privilege account to initiate the SAML flow - prevents mass unauthenticated internet-wide scanning, but this is a weak barrier against insider threats, credential-stuffed accounts, or attackers who have already established any foothold in the environment. The most critical risk amplifier is the target itself: Password Manager Pro and PAM360 are credential vaults and privileged session gateways, meaning successful exploitation does not merely compromise one system - it exposes the master keystore for the entire enterprise. No EPSS score was provided in the available data, and no CISA KEV listing has been identified at time of analysis, which moderates automated exploitation risk estimates. However, Zohocorp ManageEngine products have historically attracted active exploitation (multiple prior CVEs reaching KEV status), and SAML bypass vulnerabilities in identity-adjacent software are operationally valuable to threat actors. The absence of KEV and POC should not be interpreted as low urgency given the target profile.

An attacker who possesses a low-privilege account in the integrated Identity Provider - or any minimal foothold within the application sufficient to initiate a SAML authentication flow - crafts a modified SAML assertion claiming administrative roles or impersonating a highly privileged user. The assertion is submitted to the Password Manager Pro or PAM360 service provider endpoint, which fails to correctly verify the cryptographic signature and grants a valid administrative session. The attacker then exports all stored credentials, modifies privileged access policies, or uses the PAM platform's session brokering features to connect directly to downstream servers without triggering additional authentication challenges. No confirmed public proof-of-concept exploit code has been identified at time of analysis.