CVE-2022-35405 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-09-22
Zoho ManageEngine Password Manager Pro, PAM360, and Access Manager Plus are vulnerable to remote code execution due to a Java deserialization flaw in the XML-RPC interface. The vulnerability allows unauthenticated attackers to execute arbitrary code on Password Manager Pro and PAM360, while Access Manager Plus requires authentication for exploitation.
Yes. CVE-2022-35405 is known to be exploited in the wild, first recorded on 22 September 2022. Treat it as urgent.
How severe is CVE-2022-35405?
Critical severity, with a CVSS score of 9.8, published 22 September 2022.
Which products and versions are affected?
Zoho ManageEngine Password Manager Pro before 12101; Zoho ManageEngine PAM360 before 5510; Zoho ManageEngine Access Manager Plus before 4303.
Is there a fix for CVE-2022-35405?
A patch was published on 2022-07-19: Vendor advisory and patches released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-35405 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-35405?
Check whether you run Zoho ManageEngine. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Zoho ManageEngine Password Manager Pro before 12101
Zoho ManageEngine PAM360 before 5510
Zoho ManageEngine Access Manager Plus before 4303
Timeline
2022-07-19: disclosed: NVD Published Date
2022-09-22: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-07-19: patched: Vendor advisory and patches released
2022-09-22: exploited: Reported as exploited in the wild per CISA KEV entry date