ZeroDay Findings
Sign inSign up

Findings

CVE-2022-35405

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Published Jul 19, 2022 · updated Jun 16, 2026 · zohocorp manageengine access manager plus

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Timeline

Detection, updates, and resolution for this record.

  1. Jul 19, 2022 · Catalog

    Detected

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

  2. Sep 22, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Oct 13, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Required action

Apply updates per vendor instructions.

CISA due date Oct 13, 2022

Affected

  • cpe zohocorp/manageengine access manager plusversion unspecified
  • cpe zohocorp/manageengine access manager plus4.3
  • cpe zohocorp/manageengine pam360version unspecified
  • cpe zohocorp/manageengine pam3605.5
  • cpe zohocorp/manageengine password manager proversion unspecified
  • cpe zohocorp/manageengine password manager pro12.1
  • vendor Zoho ManageEngineversion unspecified

Sources

  • CISA KEVCVE-2022-35405

    Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2022-35405

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-35405

    30-day exploitation probability 99.9%

    first.org
  • Metasploit Modulesexploit_windows/http/zoho_password_manager_pro_xml_rpc_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-35405

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References