What is the CVSS score of EUVD-2026-57740?

EUVD-2026-57740 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of ManageEngine Password Manager Pro are affected by EUVD-2026-57740?

ManageEngine Password Manager Pro and PAM360 contain an authenticated SQL injection vulnerability (CVE-2026-11840, CVSS 8.8) that could enable any user with low-level credentials to read, modify, or…. A patch is available.

How to fix or mitigate EUVD-2026-57740?

Within 24 hours, identify all ManageEngine Password Manager Pro installations (before build 13232) and PAM360 deployments (before build 8552); verify exact build versions against vulnerability threshold; and immediately restrict network access to administrative IP ranges only, blocking all other authentication attempts to these systems. Within 7 days, enable comprehensive audit logging of all database queries and authentication events; configure real-time alerting for SQL-pattern anomalies and privilege escalations; and conduct a 90-day access review for suspicious activity by any authenticated user. Within 30 days, establish daily contact with Zohocorp to track patch availability; when builds 13232 (Password Manager Pro) and 8552 (PAM360) are released, schedule emergency maintenance and deploy immediately as top priority, overriding all other updates given these systems' credential-management criticality.

ManageEngine Password Manager Pro EUVD-2026-57740

| CVE-2026-11840 HIGH

SQL Injection (CWE-89)

2026-08-13 Zohocorp

GHSA-h4mg-pmfg-hhc5

SQLi Zoho Manageengine Pam360 Manageengine Password Manager Pro Zohocorp

8.8

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable post-authentication SQL injection; low-privilege account sufficient; full CIA impact on credential database confirmed by vendor description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 13, 2026 - 09:15 EUVD

Analysis Generated

Aug 13, 2026 - 08:16 vuln.today

CVE Published

Aug 13, 2026 - 07:35 cve.org

HIGH 8.8

DescriptionCVE.org

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

AnalysisAI

Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-supplied input is incorporated into a database query without adequate sanitization or parameterization. Both affected products - identified by CPE strings cpe:2.3:a:zohocorp:manageengine_password_manager_pro and cpe:2.3:a:zohocorp:manageengine_pam360 - are enterprise Java-based privileged access management solutions backed by a relational database (typically PostgreSQL or MS SQL Server depending on deployment). SQL injection at this layer is particularly damaging because these platforms store privileged credentials, SSH keys, certificates, and access policies in their backend databases. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms the flaw is reachable over the network without complex conditions, requiring only low-privilege authenticated access - consistent with an injection point exposed to standard user-facing API or UI endpoints post-login.

RemediationAI

Upgrade ManageEngine Password Manager Pro to build 13232 or later and ManageEngine PAM360 to build 8552 or later as the primary remediation, per the vendor advisory at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-11840.html. If immediate patching is not feasible, restrict access to the Password Manager Pro and PAM360 web interfaces to only trusted internal IP ranges at the network or WAF layer, which reduces exposure to network-reachable exploitation while not eliminating risk from insider accounts. Additionally, review and minimize the number of user accounts with login access to these platforms, enforcing the principle of least privilege, as the vulnerability requires only low-privilege authentication. Enable database-level audit logging to detect anomalous query patterns as a detection compensating control. Note that network restrictions do not eliminate the SQL injection vulnerability itself - they only limit who can reach the login interface.