CVE-2022-35405: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-09-22. EPSS: 99.9% chance of exploitation in the next 30 days.

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected products

• Zohocorp ManageEngine Access Manager Plus: before 4.3 (fixed in 4.3); version 4.3 only
• Zohocorp ManageEngine PAM360: before 5.5 (fixed in 5.5); version 5.5 only
• Zohocorp ManageEngine Password Manager Pro: before 12.1 (fixed in 12.1); version 12.1 only

Published 2022-07-19. Last modified 2026-06-17.