CVE-2022-43671: Zohocorp ManageEngine Access Manager Plus

Critical severity, CVSS 9.8. EPSS: 74.8% chance of exploitation in the next 30 days.

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.

Affected products

• Zohocorp ManageEngine Access Manager Plus: before 4.3 (fixed in 4.3); version 4.3 only
• Zohocorp ManageEngine PAM360: before 5.7 (fixed in 5.7); version 5.7 only
• Zohocorp ManageEngine Password Manager Pro: before 12.1 (fixed in 12.1); version 12.1 only

Published 2022-11-12. Last modified 2026-06-17.