Password Manager Pro EUVD-2026-115106

Requires a valid authenticated session on the ManageEngine Password Manager Pro or PAM360 web interface with at least low privileges (CVSS PR:L) - exploitation is not possible pre-authentication. Given AV:N, the instance must be network-reachable to the attacker. The available sources do not identify the specific vulnerable feature, endpoint, or parameter, nor any non-default configuration requirement, so the exact command-injection trigger is not described in the available sources. The limiting factor is the authentication prerequisite: realistic abuse depends on an attacker first obtaining or being granted a low-privilege account, making insiders and post-credential-theft chaining the primary threat. The vendor-listed fixes are Password Manager Pro build 13236 and PAM360 build 8601; upgrading to these builds is the remediation stated by the source.

This is a credible near-term priority, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) describes a network-reachable, low-complexity command-injection flaw (CWE-78) that requires only low-privilege authentication and yields full compromise of the host - on a Privileged Access Management / password-vault product, that host holds the organization's most sensitive credentials, which materially raises impact beyond the raw 8.8. Working against that urgency: the flaw is NOT in CISA KEV, no EPSS score was supplied, and no public exploit or PoC reference was provided - only the vendor advisory - so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with 'serious, patch promptly, but no confirmed exploitation.' The main caveat is the authentication requirement (PR:L): exploitation presupposes an attacker already holds a valid low-privilege account, which narrows the realistic threat to insiders, credential-phishing follow-on, or chained post-auth attacks. EPSS and KEV data being absent means the probability signal is simply unavailable rather than low.

An attacker who already holds a low-privileged authenticated account on an exposed ManageEngine Password Manager Pro or PAM360 instance sends a crafted request that injects operating-system commands (CWE-78), achieving remote code execution on the vault server. Because the product stores privileged credentials, this escalates into full compromise of the secrets it manages. No public exploit or PoC reference was provided at the time of analysis.