{"id":"CVE-2022-35405","kind":"vulnerability","aliases":["CVE-2022-35405"],"related":[],"title":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote…","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","summary":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified flaw that allows remote code execution. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2022-09-22T00:00:00+00:00","products":[{"name":"Zoho ManageEngine","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zohocorp manageengine access manager plus","fixed":["4.3"],"affected":"< 4.3","ecosystem":"vendor"},{"name":"zohocorp manageengine access manager plus","fixed":[],"affected":"= 4.3","ecosystem":"vendor"},{"name":"zohocorp manageengine pam360","fixed":["5.5"],"affected":"< 5.5","ecosystem":"vendor"},{"name":"zohocorp manageengine pam360","fixed":[],"affected":"= 5.5","ecosystem":"vendor"},{"name":"zohocorp manageengine password manager pro","fixed":["12.1"],"affected":"< 12.1","ecosystem":"vendor"},{"name":"zohocorp manageengine password manager pro","fixed":[],"affected":"= 12.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["access-manager-plus","exploited","manageengine","pam360","password-manager-pro","vendor","zoho"],"not_affected_if":["unknown"],"how_to_check":"Identify the installed PAM360, Password Manager Pro, or Access Manager Plus version and compare it with the vendor advisory; the sources do not give the affected version range.","fix":"Apply the vendor update for the affected product, per CISA's required action; the sources do not name the fixed version.","status":"open","published_at":"2022-07-19T15:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:34+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:10:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update for the affected product, per CISA's required action; the sources do not name the fixed version.","reach":"unknown","impact":"high","summary":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified flaw that allows remote code execution. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["zoho","manageengine","pam360","password-manager-pro","access-manager-plus"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server hosting the password manager.","analyst_note":"Find the affected version range and fixed build from Zoho's advisory for CVE-2022-35405; the KEV entry gives no versions.","how_to_check":"Identify the installed PAM360, Password Manager Pro, or Access Manager Plus version and compare it with the vendor advisory; the sources do not give the affected version range.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000479,"input_tokens":2805,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-35405':19A,22A '12101':7A,98C '4303':118C '5510':11A,102C 'access':27A,32A,52B,71B,114C 'access-manager-plus':51B 'activ':87B 'affect':112C 'allow':79B 'also':111C 'authent':120C 'cisa':83B 'code':81B,108C 'contain':74B 'cve':17A,20A 'execut':82B,109C 'exploit':55B,88B 'flaw':77B 'list':84B 'manag':4A,53B,60B,68B,72B,95C,115C 'manageengin':2A,56B,65B,93C,113C 'manageengine':24A,26A,31A,36A,39A,42A,47A 'manager':28A,33A,44A,49A 'pam360':9A,37A,40A,57B,66B,100C 'password':3A,43A,48A,59B,67B,94C 'password-manager-pro':58B 'plus':29A,34A,54B,73B,116C 'pro':5A,45A,50A,61B,69B,96C 'remot':16A,80B,107C 'unauthent':15A,106C 'unspecifi':76B 'vendor':62B 'vulner':13A,104C 'wild':91B 'zoho':1A,23A,63B,64B,92C 'zohocorp':25A,30A,35A,38A,41A,46A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-07-19T15:15:08+00:00","kev":{"dateAdded":"2022-09-22","dueDate":"2022-10-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-35405","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-35405","severity":null,"published_at":"2022-09-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-35405","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35405","severity":null,"published_at":"2022-07-19T15:15:08+00:00","modified_at":"2026-06-17T04:51:46+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}