[ CVE-2022-35405 · Published 19 Jul 2022 ]
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 100%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-09-22
- EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
CISA: Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 13 Oct 2022): Apply updates per vendor instructions.
- Patch on manageengine.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserializa…ExploitThird Party AdvisoryVDB Entry
- www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.htmlPatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource