Read the docs
TI-2022-11635 Aliases CVE-2022-29081GHSA-59xq-494m-chp8

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and…

Priority HIGH 83CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.

Why it matters now

EPSS 0.83543 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.0:build4000:*:*:*:*:*:*4.0 build4000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4100:*:*:*:*:*:*4.1 build4100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4101:*:*:*:*:*:*4.1 build4101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4200:*:*:*:*:*:*4.2 build4200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4201:*:*:*:*:*:*4.2 build4201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4202:*:*:*:*:*:*4.2 build4202VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4203:*:*:*:*:*:*4.2 build4203VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*4.3 build4300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*4.3 build4301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4001:*:*:*:*:*:*4.0 build4001VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.0:build4000:*:*:*:*:*:* Versions 4.0 build4000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4100:*:*:*:*:*:* Versions 4.1 build4100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4101:*:*:*:*:*:* Versions 4.1 build4101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4200:*:*:*:*:*:* Versions 4.2 build4200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4201:*:*:*:*:*:* Versions 4.2 build4201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4202:*:*:*:*:*:* Versions 4.2 build4202 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4203:*:*:*:*:*:* Versions 4.2 build4203 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* Versions 4.3 build4300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* Versions 4.3 build4301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4001:*:*:*:*:*:* Versions 4.0 build4001 Vulnerable ·Zohocorp
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4002:*:*:*:*:*:*4.0 build4002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4100:*:*:*:*:*:*4.1 build4100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4101:*:*:*:*:*:*4.1 build4101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4500:*:*:*:*:*:*4.5 build4500VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4501:*:*:*:*:*:*4.5 build4501VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5000:*:*:*:*:*:*5.0 build5000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5001:*:*:*:*:*:*5.0 build5001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5002:*:*:*:*:*:*5.0 build5002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5003:*:*:*:*:*:*5.0 build5003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5004:*:*:*:*:*:*5.0 build5004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.1:build5100:*:*:*:*:*:*5.1 build5100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.2:build5200:*:*:*:*:*:*5.2 build5200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5300:*:*:*:*:*:*5.3 build5300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5301:*:*:*:*:*:*5.3 build5301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5302:*:*:*:*:*:*5.3 build5302VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.4:build5400:*:*:*:*:*:*5.4 build5400VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:*:*:*:*10.1 build10103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10104:*:*:*:*:*:*10.1 build10104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.2:build10200:*:*:*:*:*:*10.2 build10200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10300:*:*:*:*:*:*10.3 build10300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10301:*:*:*:*:*:*10.3 build10301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10302:*:*:*:*:*:*10.3 build10302VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10400:*:*:*:*:*:*10.4 build10400VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10401:*:*:*:*:*:*10.4 build10401VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10402:*:*:*:*:*:*10.4 build10402VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:11104:*:*:*:*:*:*11.1 11104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11101:*:*:*:*:*:*11.1 build_11101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11102:*:*:*:*:*:*11.1 build_11102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11103:*:*:*:*:*:*11.1 build_11103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11200:*:*:*:*:*:*11.2 build11200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11201:*:*:*:*:*:*11.2 build11201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11300:*:*:*:*:*:*11.3 build11300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11301:*:*:*:*:*:*11.3 build11301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12000:*:*:*:*:*:*12.0 build12000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12001:*:*:*:*:*:*12.0 build12001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12002:*:*:*:*:*:*12.0 build12002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12003:*:*:*:*:*:*12.0 build12003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12004:*:*:*:*:*:*12.0 build12004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12005:*:*:*:*:*:*12.0 build12005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12006:*:*:*:*:*:*12.0 build12006VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4002:*:*:*:*:*:* Versions 4.0 build4002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4100:*:*:*:*:*:* Versions 4.1 build4100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4101:*:*:*:*:*:* Versions 4.1 build4101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4500:*:*:*:*:*:* Versions 4.5 build4500 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4501:*:*:*:*:*:* Versions 4.5 build4501 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5000:*:*:*:*:*:* Versions 5.0 build5000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5001:*:*:*:*:*:* Versions 5.0 build5001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5002:*:*:*:*:*:* Versions 5.0 build5002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5003:*:*:*:*:*:* Versions 5.0 build5003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5004:*:*:*:*:*:* Versions 5.0 build5004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.1:build5100:*:*:*:*:*:* Versions 5.1 build5100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.2:build5200:*:*:*:*:*:* Versions 5.2 build5200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5300:*:*:*:*:*:* Versions 5.3 build5300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5301:*:*:*:*:*:* Versions 5.3 build5301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5302:*:*:*:*:*:* Versions 5.3 build5302 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.4:build5400:*:*:*:*:*:* Versions 5.4 build5400 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:*:*:*:* Versions 10.1 build10103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10104:*:*:*:*:*:* Versions 10.1 build10104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.2:build10200:*:*:*:*:*:* Versions 10.2 build10200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10300:*:*:*:*:*:* Versions 10.3 build10300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10301:*:*:*:*:*:* Versions 10.3 build10301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10302:*:*:*:*:*:* Versions 10.3 build10302 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10400:*:*:*:*:*:* Versions 10.4 build10400 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10401:*:*:*:*:*:* Versions 10.4 build10401 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10402:*:*:*:*:*:* Versions 10.4 build10402 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:11104:*:*:*:*:*:* Versions 11.1 11104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11101:*:*:*:*:*:* Versions 11.1 build_11101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11102:*:*:*:*:*:* Versions 11.1 build_11102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11103:*:*:*:*:*:* Versions 11.1 build_11103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11200:*:*:*:*:*:* Versions 11.2 build11200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11201:*:*:*:*:*:* Versions 11.2 build11201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11300:*:*:*:*:*:* Versions 11.3 build11300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11301:*:*:*:*:*:* Versions 11.3 build11301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12000:*:*:*:*:*:* Versions 12.0 build12000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12001:*:*:*:*:*:* Versions 12.0 build12001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12002:*:*:*:*:*:* Versions 12.0 build12002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12003:*:*:*:*:*:* Versions 12.0 build12003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12004:*:*:*:*:*:* Versions 12.0 build12004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12005:*:*:*:*:*:* Versions 12.0 build12005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12006:*:*:*:*:*:* Versions 12.0 build12006 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29081
  2. 2026-10-03 Alias added: GHSA-59xq-494m-chp8

References

Exploit 1

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21434 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access… CVSS 3.1CRITICAL 9.8
  • TI-2022-19138 Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550… CVSS 3.1CRITICAL 9.8
  • TI-2022-23597 Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and… CVSS 3.1CRITICAL 9.8
  • TI-2022-21435 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access… CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences