CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2022-07-19

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2022-09-22, action due 2022-10-13: Apply updates per vendor instructions.

Weaknesses

CWE-502

Affected products

• Manageengine Access Manager Plus (Zohocorp)
• Manageengine Pam360 (Zohocorp)
• Manageengine Password Manager Pro (Zohocorp)

References

• http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405