CVE-2022-35405

Deeper analysis

Zoho ManageEngine Password Manager Pro versions prior to 12101 and PAM360 versions prior to 5510 contain an unauthenticated remote code execution vulnerability stemming from unsafe deserialization of untrusted data (CWE-502). The same issue affects ManageEngine Access Manager Plus before version 4303, although that product requires authentication for exploitation. The flaw carries a CVSS 3.1 score of 9.8 and resides in the XML-RPC handling path of these password and privileged-access management products.

An unauthenticated remote attacker can submit a crafted XML-RPC request that triggers Java deserialization, resulting in arbitrary code execution on the server. Successful exploitation grants the attacker full confidentiality, integrity, and availability impact without any user interaction or prior credentials.

Vendor advisories from ManageEngine direct customers to upgrade Password Manager Pro to 12101 or later, PAM360 to 5510 or later, and Access Manager Plus to 4303 or later. Public exploit code targeting the deserialization vector has been published, and the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog.

The associated EPSS score reached a peak of 0.9753 and currently stands at 0.9420, indicating sustained and substantial exploitation interest following disclosure.