Authenticated SQL Injection in Zohocorp ManageEngine Password Manager Pro and PAM360
CVE-2026-11840

8.8HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Password Manager Pro
Manageengine Pam360
Vendor
CVE Published:
13 August 2026

What is CVE-2026-11840?

Zohocorp's ManageEngine Password Manager Pro and PAM360 products are exposed to an authenticated SQL injection vulnerability. This flaw could allow an attacker with valid credentials to manipulate database queries and potentially access sensitive information. It is essential for users to update their installations to the latest versions to mitigate these risks.

Affected Version(s)

ManageEngine PAM360 0 < 8552

ManageEngine Password Manager Pro 0 < 13232

References

https://www.manageengine.com/products/passwordmanagerpro/...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.