What is the CVSS score of CVE-2026-5785?

CVE-2026-5785 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ManageEngine PAM360 are affected by CVE-2026-5785?

SQL injection vulnerability in ManageEngine PAM360 and Password Manager Pro enables extraction and modification of the organization's entire stored credential vault.. A patch is available.

How to fix or mitigate CVE-2026-5785?

Within 24 hours: Inventory all systems running vulnerable ManageEngine PAM360 builds (prior to 8531) and Password Manager Pro builds (8600-13230); restrict query report module access pending patch deployment. Within 7 days: Deploy vendor patch to build 8531 or later for PAM360 and build 13231 or later for PMP across all production instances. Within 30 days: Audit access logs for suspicious query report activity, rotate all potentially exposed credentials, and re-enable report module access after verification.

ManageEngine PAM360 CVE-2026-5785

EUVD-2026-23239 HIGH

SQL Injection (CWE-89)

2026-04-16 Zohocorp

GHSA-wg7c-97pm-qp3w

Zoho SQLi Manageengine Pam360 Manageengine Password Manager Pro

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable web module exploitable with any authenticated low-privilege account (PR:L), no user interaction; SQLi yields high confidentiality and integrity impact but no availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:39 vuln.today

Patch released

Apr 17, 2026 - 15:17 nvd

Patch available

Apr 16, 2026 - 15:01 EUVD

EUVD ID Assigned

Apr 16, 2026 - 14:00 euvd

EUVD-2026-23239

CVE Published

Apr 16, 2026 - 13:46 nvd

HIGH 8.1

DescriptionCVE.org

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

AnalysisAI

SQL injection in Zohocorp ManageEngine PAM360 (before build 8531) and Password Manager Pro (builds 8600 through 13230) lets an authenticated attacker inject arbitrary SQL through the query report module, enabling extraction and modification of privileged-vault data. Because these products are enterprise password/privileged-access managers, a successful injection can expose stored credentials and secrets for an entire environment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and a vendor patch is available.

Technical ContextAI

Both affected products are Zohocorp/ManageEngine privileged access and password management platforms (CPE cpe:2.3:a:zohocorp:manageengine_pam360 and cpe:2.3:a:zohocorp:manageengine_password_manager_pro), Java-based web applications backed by a relational database that stores credentials, certificates, and privileged sessions. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaching the query report module is concatenated into a SQL statement without adequate parameterization or sanitization. Because the report module is expected to run authenticated queries against the backing datastore, an attacker who can influence report parameters can pivot that trust into direct database access.

RemediationAI

Vendor-released patch: upgrade PAM360 to build 8531 or later, and upgrade Password Manager Pro to a build newer than 13230, as directed in the vendor advisory at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-5785.html (NVD reference https://nvd.nist.gov/vuln/detail/CVE-2026-5785). Because exploitation requires an authenticated account (PR:L), interim compensating controls until patching include restricting access to the web console to trusted management networks or VPN, tightening and reviewing which low-privilege accounts can reach the query report module, disabling or limiting report functionality for non-administrative users where the product allows it, and enabling database and application query logging to detect anomalous SQL patterns; the trade-off is that restricting the report module may disrupt legitimate reporting workflows for operators who depend on it.