CVE-2022-29081: Zohocorp ManageEngine Access Manager Plus

Critical severity, CVSS 9.8. EPSS: 83.5% chance of exploitation in the next 30 days.

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.

Affected products

• Zohocorp ManageEngine Access Manager Plus: version 4.0 only; version 4.1 only; version 4.2 only; version 4.3 only
• Zohocorp ManageEngine PAM360: version 4.0 only; version 4.1 only; version 4.5 only; version 5.0 only; version 5.1 only; version 5.2 only; …
• Zohocorp ManageEngine Password Manager Pro: version 10.1 only; version 10.2 only; version 10.3 only; version 10.4 only; version 11.1 only; version 11.2 only; …

Published 2022-04-28. Last modified 2026-06-17.