CVE-2022-35405: Zoho ManageEngine Password Manager Pro / PAM360 unauthenticated RCE, actively exploited
The short version: CVE-2022-35405 is an unauthenticated remote code execution flaw — via unsafe Java deserialization — in Zoho ManageEngine Password Manager Pro and PAM360 (and, with authentication, Access Manager Plus). These are privileged-access and password-vault products, so code execution here reaches a very sensitive server. It scores 9.8, it was exploited in the wild, and it's in CISA's KEV catalog. Patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.94% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2022-09-22, remediation due 2022-10-13 |
| Known exploited? | Yes — actively exploited in the wild |
| Vulnerability type | CWE-502 deserialization of untrusted data → unauthenticated remote code execution |
| Requires authenticated session? | No for Password Manager Pro and PAM360; Access Manager Plus requires authentication |
| Affected | Password Manager Pro before 12101 · PAM360 before 5510 · Access Manager Plus before 4303 (with authentication) |
| Fixed in | Password Manager Pro 12101 · PAM360 5510 · Access Manager Plus 4303 (and later) |
What you need to know
Password Manager Pro and PAM360 are privileged-access management and password-vault products — exactly the kind of system that holds the keys to everything else. CVE-2022-35405 is an unsafe Java deserialization flaw: the application deserializes attacker-controlled data, which can be crafted to execute code on the server. For Password Manager Pro and PAM360 this is unauthenticated; Access Manager Plus is affected too, but requires authentication.
Why it's a top-priority item:
- It's pre-authentication on the vault products. No credential needed to reach code execution on Password Manager Pro or PAM360.
- The target is uniquely sensitive. A privileged-access / password-vault server, compromised, can expose the credentials that unlock the rest of the estate.
- It was live. Exploitation was observed in the wild, and CISA added it to KEV — an exceptionally high EPSS reflects broad exploitation interest.
How serious we see it
Critical — the 9.8 is warranted, and the target makes it worse than a typical 9.8.
Unauthenticated code execution on a system whose entire job is guarding privileged credentials is about as consequential as external exposure gets. The bounded, reassuring part is that it's narrow and fixable: specific products and version floors, published fixes, and a fast exposure check. The catch is that a compromise here can cascade into the credentials it protects — so if the server was reachable pre-patch, treat rotation of vaulted secrets as part of the response, not an afterthought.
Recommendations
Straight from ManageEngine's advisory and CISA:
- Patch now. Upgrade to Password Manager Pro 12101 / PAM360 5510 / Access Manager Plus 4303 or later.
- Hunt. Review logs for requests to the affected endpoint and for signs of code execution on the server.
- If compromised, respond — and rotate the vault. Rebuild the host, and rotate the privileged credentials and secrets the product managed, since those are the real prize.
- Harden exposure. Keep privileged-access management servers off the public internet; restrict them to trusted administrative networks.
- Confirm your exposure first. Verify whether you run an affected build at all.
How BreachRisk sees it
BreachRisk discovers internet-facing ManageEngine Password Manager Pro, PAM360, and Access Manager Plus instances from little more than your domain, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV. Because the affected endpoint is remotely checkable, BreachRisk can go beyond version-matching and safely confirm whether the vulnerable endpoint is reachable and responding, as a bounded, benign check rather than a weaponized exploit.
That continuous, attacker's-eye view matters most for a system like this: a privileged-access server exposed to the internet is mapped and ranked immediately, so you can move straight to patch-and-verify.