CVE-2022-35405

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

99.94%

Published

Jul 19, 2022

Modified

Oct 31, 2025

CISA Known Exploited Vulnerability

Added: 2022-09-22 · Due: 2022-10-13

Apply updates per vendor instructions.

Public PoC / Exploit (3)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index GitHub PoCviniciuspereiras/CVE-2022-35405★31

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502CWE-502

Affected Products (8)

zohocorp · manageengine_access_manager_plus (up to 4.3)vulnerable

zohocorp · manageengine_access_manager_plusvulnerable

zohocorp · manageengine_pam360 (up to 5.5)vulnerable

zohocorp · manageengine_pam360vulnerable

zohocorp · manageengine_password_manager_pro (up to 12.1)vulnerable

zohocorp · manageengine_password_manager_provulnerable

References (5)

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html

ExploitThird Party AdvisoryVDB Entry

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html

PatchVendor Advisory

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html

ExploitThird Party AdvisoryVDB Entry

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs