EUVD-2026-69888
GHSA-f8wg-7fm8-7r3f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app, low complexity; PR:L because a valid application account is required; full CIA impact on a credential vault database.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
3DescriptionCVE.org
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
AnalysisAI
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege access to the ManageEngine Password Manager Pro, PAM360, or Access Manager Plus web interface; the CVSS PR:L metric confirms that standard user-level credentials are sufficient and no administrative role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: the attack is network-reachable, requires low complexity, and only a basic authenticated session - any valid PAM user account is sufficient. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ManageEngine Password Manager Pro to build 13235 or later, PAM360 to build 8561 or later, and Access Manager Plus to build 4405 or later as specified in the Zohocorp advisory at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-14828.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployed instances of ManageEngine Password Manager Pro, PAM360, and Access Manager Plus, and audit which user accounts have database access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today