Authentication Bypass in Zohocorp ManageEngine Password Manager Pro and PAM360
CVE-2026-12263

8.8HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Password Manager Pro
Manageengine Pam360
Vendor
CVE Published:
13 August 2026

What is CVE-2026-12263?

The authentication bypass vulnerability in Zohocorp's ManageEngine Password Manager Pro and PAM360 stems from improper validation of Security Assertion Markup Language (SAML) tokens. This flaw allows unauthorized access to sensitive functionalities, posing significant security risks to user accounts and sensitive information.

Affected Version(s)

ManageEngine PAM360 0 < 8551

ManageEngine Password Manager Pro 0 < 13232

References

https://www.manageengine.com/products/passwordmanagerpro/...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.