Loading story…
Zoho has patched CVE-2026-11840, a high-severity authenticated SQL injection vulnerability in ManageEngine Password Manager Pro and ManageEngine PAM360. The flaw is described as remotely exploitable and carries a CVSS v3.1 score of 8.8, with potential impact on confidentiality, integrity, and availability in affected privileged access management deployments.
The issue affects Password Manager Pro versions earlier than build 13232 and PAM360 versions earlier than build 8552. National cybersecurity bodies, including ACN Italy and CERT-PY, have highlighted the vendor remediation, and organizations running these products have been advised to upgrade to Password Manager Pro 13232+ and PAM360 8552+ in line with Zoho's security guidance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-11840 was published as a high-severity, remotely exploitable authenticated SQL injection vulnerability affecting Zohocorp ManageEngine Password Manager Pro and PAM360. The CVE entry assigns a CVSS v3.1 base score of 8.8 and notes potential impacts to confidentiality, integrity, and availability.
Zoho released security updates to remediate a high-severity authenticated SQL injection vulnerability affecting ManageEngine Password Manager Pro versions before build 13232 and PAM360 versions before build 8552. The vendor-directed remediation is to upgrade Password Manager Pro to version 13232 or later and PAM360 to version 8552 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecvefeed.io
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **CVE-2022-35405**, a pre-authentication remote code execution flaw in **Zoho/ManageEngine Password Manager Pro**, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects. After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a **single point of failure**: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching **Domain Admin** in enterprise environments.
Jul 24, 2026
A critical unauthenticated SQL injection vulnerability, tracked as CVE-2025-8324 with a CVSS score of 9.8, has been identified in Zoho Analytics Plus (also known as Zohocorp ManageEngine Analytics Plus) versions 6170 and below. This flaw arises from improper filter configuration, allowing remote attackers to exploit the vulnerability without authentication, potentially leading to full data takeover and exposure of sensitive information. Security advisories emphasize the severity of this issue, highlighting the risk of unauthorized access and manipulation of analytics data. Organizations using affected versions are urged to apply available patches or mitigations immediately to prevent exploitation, as the vulnerability is remotely exploitable and could be leveraged in targeted attacks against enterprise environments relying on Zoho Analytics Plus for business intelligence and reporting.
Jun 29, 2026
ManageEngine has patched a critical unauthenticated remote code execution flaw in **ADAudit Plus** tracked as `CVE-2026-6516`, affecting all builds earlier than **8606**. The vulnerability resides in the product's Agent API and stems from a chain involving an authentication bypass and a path traversal issue, enabling attackers to execute code remotely without credentials. The issue is classified under `CWE-78`, and public reporting lists a severe network-exploitable attack path with high confidentiality and integrity impact. Zoho/ManageEngine assigned the flaw a **CVSS 10.0** score and released a fix in **build 8606**, advising customers to update the ADAudit Plus server as well as affected Windows and Mac agents. The vendor said there was no confirmed exploitation in the wild and no public proof-of-concept at the time of disclosure. The vulnerability was reported by **Linhlt of VCB**.
Jul 24, 2026