TI-2022-15981 Aliases CVE-2022-35405 GHSA-j9c5-6p9g-hwf3

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable…

CRITICAL 100Exploited in the wildCWE-502Published 2022-07-19 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Why it matters now

Exploitation Active In CISA KEV since 2022-09-22CISA due date 2022-10-13

EPSS 0.99873 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_access_manager_plus::::::::	before 4.3	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300::::::	4.3 build4300	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301::::::	4.3 build4301	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302::::::	4.3 build4302	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_pam360::::::::	before 5.5	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500::::::	5.5 build5500	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro::::::::	before 12.1	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100::::::	12.1 build12100	Vulnerable	Zohocorp

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:* Versions before 4.3 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* Versions 4.3 build4300 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* Versions 4.3 build4301 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:* Versions 4.3 build4302 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:* Versions before 5.5 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:* Versions 5.5 build5500 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:* Versions before 12.1 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:* Versions 12.1 build12100 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

2022-09-22 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2022-35405
2026-10-03 Alias added: GHSA-j9c5-6p9g-hwf3

References

Exploit 1

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html

Patch 1

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html

TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
TI-2020-08210 Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of… KEVCVSS 3.1CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences