ManageEngine Password Manager Pro CVE-2026-14828

Exploitation requires a valid authenticated session with at least low-privilege access to the ManageEngine Password Manager Pro, PAM360, or Access Manager Plus web interface; the CVSS PR:L metric confirms that standard user-level credentials are sufficient and no administrative role is needed. The application must be reachable over the network from the attacker's position. No non-default configuration, specific deployment mode, or additional feature enablement is described as a prerequisite. Limiting factors: the attacker must possess at least one valid account in the PAM application; unauthenticated access is not sufficient for exploitation.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: the attack is network-reachable, requires low complexity, and only a basic authenticated session - any valid PAM user account is sufficient. The unchanged scope (S:U) formally constrains the score, but in practice the database contents of a privileged credential vault represent the highest-value asset in an enterprise environment; lateral movement to downstream privileged systems is a near-certain consequence of a successful dump. No KEV listing and no public exploit have been reported, moderating immediate automated-exploitation risk, but EPSS data is absent from the provided intelligence so probabilistic likelihood cannot be further refined. The low privilege bar and the extraordinarily sensitive nature of the affected software combine to make this a high-priority remediation item for any organization running these products regardless of their size or sector.

An attacker holding any valid low-privilege account in the PAM application submits a crafted HTTP request containing a SQL payload to a vulnerable endpoint. The injected query bypasses parameterization, executing against the backend database and returning stored credential records - potentially including passwords for every privileged account managed by the vault. No public exploit code has been identified, but the low attack complexity means an experienced attacker could develop a working payload independently from the advisory description.