What’s Vulnerable › Vulnerabilities

CVE-2022-35405: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-09-22
• EPSS: 99.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-19 · updated 2026-06-17
• Weakness: CWE-502

Description

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected products

• Zohocorp ManageEngine Access Manager Plus: before 4.3; 4.3-build4300, 4.3-build4301, 4.3-build4302 — fixed in 4.3
• Zohocorp ManageEngine PAM360: before 5.5; 5.5-build5500 — fixed in 5.5
• Zohocorp ManageEngine Password Manager Pro: before 12.1; 12.1-build12100 — fixed in 12.1

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine Access Manager Plus 4.3; Zohocorp ManageEngine PAM360 5.5; Zohocorp ManageEngine Password Manager Pro 12.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
• http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405

Get alerted when CVE-2022-35405 or the next vulnerability affects your stack