Zoho · ManageEngine

CVE-2022-35405

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99.9%

What it is

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

CISA: Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: October 13, 2022

Added to the CISA list: September 22, 2022
Published: July 19, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.9% in the top 0.1% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Zoho

Added	Vulnerability	Product	Severity	Attack chance
Mar 7, 2023	ADSelfService Plus Remote Code ExecutionCVE-2022-28810	ManageEngine	Medium 6.8	71%
Jan 23, 2023	Multiple Products Remote Code ExecutionCVE-2022-47966used by ransomware	ManageEngine	Critical 9.8	99.8%
Nov 3, 2021	ServiceDesk Plus (SDP) File UploadCVE-2019-8394	ManageEngine	High 7.5	63%
Nov 3, 2021	Desktop Central File UploadCVE-2020-10189	ManageEngine	Critical 9.8	99.9%
Nov 3, 2021	ADSelfService Plus Authentication BypassCVE-2021-40539used by ransomware	ManageEngine	Critical 9.8	99%
Dec 10, 2021	Authentication BypassCVE-2021-44515	Desktop Central	Critical 9.8	99.9%
Dec 1, 2021	ManageEngine ServiceDesk Authentication BypassCVE-2021-37415	ManageEngine ServiceDesk Plus (SDP)	Critical 9.8	99.8%
Dec 1, 2021	ManageEngine ServiceDesk Plus Remote Code ExecutionCVE-2021-44077	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Critical 9.8	93%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.