{"id":"CVE-2022-35405","aliases":["EUVD-2022-38295","GHSA-j9c5-6p9g-hwf3"],"status":"published","title":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to...","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99873,"percentile":0.99963,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2022-07-19T14:51:47Z","modified":"2026-06-17T04:51:46Z","kev":{"date_added":"2022-09-22","due_date":"2022-10-13","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-09-22"},{"source":"kev","since":"2022-09-22"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/zoho_password_manager_pro_xml_rpc_rce","title":"Zoho Password Manager Pro XML-RPC Java Deserialization","type":"exploit","platform":"Windows","date":"2022-06-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/zoho_password_manager_pro_xml_rpc_rce"},{"source":"pocgithub","id":"viniciuspereiras/CVE-2022-35405","title":"viniciuspereiras/CVE-2022-35405","date":"2022-07-18","url":"https://github.com/viniciuspereiras/CVE-2022-35405"},{"source":"nuclei","id":"CVE-2022-35405","title":"Zoho ManageEngine - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35405.yaml"}],"products":[{"vendor":"zoho","product":"manageengine"},{"vendor":"zohocorp","product":"manageengine_access_manager_plus"},{"vendor":"zohocorp","product":"manageengine_pam360"},{"vendor":"zohocorp","product":"manageengine_password_manager_pro"}],"references":[{"url":"https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35405"},{"url":"https://github.com/advisories/GHSA-j9c5-6p9g-hwf3"}],"sources":{"cve":[{"id":"CVE-2022-35405","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","status":"published","published":"2022-07-19T14:51:47Z","modified":"2025-10-21T23:15:38.007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38295","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","status":"published","published":"2022-07-19T14:51:47Z","modified":"2025-10-21T23:15:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-09-22","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-j9c5-6p9g-hwf3","title":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to...","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","status":"published","published":"2022-07-20T00:00:22Z","modified":"2025-10-22T00:32:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-35405","title":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","description":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.","cwes":["CWE-502"],"kev":{"date_added":"2022-09-22","due_date":"2022-10-13","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-35405","description":"Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)","status":"published","published":"2022-07-19T15:15:08.68Z","modified":"2026-06-17T04:51:46.637Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:23.686531Z"}]}}