CVE-2026-5785

High

Published: 16 April 2026

Published

16 April 2026

Modified

17 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0002 6.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5785 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents SQL injection by requiring validation and error handling of user inputs to the query report module.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation through patching to fixed versions (PAM360 8531+ or Password Manager Pro 13230+), eliminating the specific SQL injection vulnerability.

RA-5 Vulnerability Monitoring and Scanning good match

preventdetect

Requires vulnerability scanning that identifies SQL injection flaws like CVE-2026-5785 in ManageEngine applications for subsequent remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing password manager web app directly enables T1190 for remote exploitation; facilitates arbitrary DB queries for data access (T1213.006) and modification (T1565.001) of credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

Deeper analysisAI

CVE-2026-5785 is an authenticated SQL injection vulnerability (CWE-89) in the query report module of Zoho Corp's ManageEngine PAM360 versions prior to 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230. Published on 2026-04-16, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for remote exploitation with significant impacts on data confidentiality and integrity.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation enables high-impact unauthorized access to sensitive data (C:H) and modification of database contents (I:H), while availability remains unaffected (A:N), potentially allowing attackers to extract or alter privileged credentials managed by these password management tools.

Mitigation requires upgrading to patched versions: ManageEngine PAM360 version 8531 or later, and ManageEngine Password Manager Pro versions beyond 13230. Additional details are available in the vendor advisory at https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-5785.html.