ManageEngine PAM360 EUVD-2026-23239

Exploitation requires an authenticated session on the affected product (CVSS PR:L) and access to the query report module, which is the specific vulnerable feature named in the advisory; the attacker supplies malicious input to that module's report queries. Limiting factors: a valid application account is mandatory (no unauthenticated path, PR:L), the target must be running PAM360 before build 8531 or Password Manager Pro build 8600-13230, and no user interaction by a victim is needed (UI:N). This is not a default-configuration remote-unauthenticated bug - the authentication requirement is the primary constraint that narrows realistic exploitation to insiders or attackers holding stolen credentials.

The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): network-reachable, low complexity, requires low privileges (PR:L, i.e. an authenticated but not necessarily administrative account), no user interaction, high confidentiality and integrity impact, no availability impact. Signals conflict on real-world urgency: SSVC rates Technical Impact as 'total' but Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.02% (6th percentile), with no KEV listing and no known public exploit. The high CVSS is driven by the sensitive nature of a credential vault (total technical impact once exploited), not by ease or breadth of exploitation - the PR:L requirement means an attacker must first hold a valid application account, which meaningfully limits mass exploitation. Net assessment: patch promptly given the crown-jewel data at stake, but this is a targeted/insider-weighted risk rather than an internet-wide worm-class threat.

An attacker who has obtained or been granted a low-privilege PAM360 or Password Manager Pro account - for example a malicious insider or someone reusing phished credentials - navigates to the query report module and submits crafted report parameters containing SQL payloads. The low attack complexity (AC:L) and network vector let them iteratively extract stored credentials and privileged secrets from the backing database, or alter records (C:H/I:H). No public proof-of-concept exploit code has been identified at time of analysis.