Is CVE-2026-14828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14828 being exploited in the wild.

How severe is CVE-2026-14828?

High severity, with a CVSS score of 8.8, published 2 September 2026.

Which products and versions are affected?

Zohocorp Access Manager Plus before 4405; Zohocorp PAM360 before 8561; Zohocorp Password Manager Pro before 13235.

Is there a fix for CVE-2026-14828?

A patch was published on 2026-07-07: Fixed versions released: Password Manager Pro 13235, PAM360 8561, Access Manager Plus 4405 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14828 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-14828?

Check whether you run Zohocorp Access Manager Plus, Zohocorp PAM360 or Zohocorp Password Manager Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14828: Zohocorp ManageEngine SQL Injection in password management suite

CVE-2026-14828 · Severity: high · CVSS 8.8 · Published 2026-09-02

Zohocorp ManageEngine's Password Manager Pro, PAM360, and Access Manager Plus are privilege and password management platforms used to secure credentials and control privileged access in enterprise environments. An authenticated SQL injection vulnerability allows users or attackers with valid credentials to execute arbitrary database queries, potentially exposing sensitive password vaults, session logs, and administrative data stored in these systems.

Vendors: Zohocorp.

Quick answers

Is CVE-2026-14828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14828 being exploited in the wild.
How severe is CVE-2026-14828?: High severity, with a CVSS score of 8.8, published 2 September 2026.
Which products and versions are affected?: Zohocorp Access Manager Plus before 4405; Zohocorp PAM360 before 8561; Zohocorp Password Manager Pro before 13235.
Is there a fix for CVE-2026-14828?: A patch was published on 2026-07-07: Fixed versions released: Password Manager Pro 13235, PAM360 8561, Access Manager Plus 4405 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14828 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-14828?: Check whether you run Zohocorp Access Manager Plus, Zohocorp PAM360 or Zohocorp Password Manager Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated SQL injection vulnerability exists in Password Manager Pro, PAM360, and Access Manager Plus, allowing an attacker who has valid credentials to craft malicious SQL queries and execute unintended database operations. The vulnerability requires authentication, limiting the attack surface to authorized users or compromised accounts. An attacker can exploit this to read, modify, or delete sensitive data including stored credentials, audit logs, and policy configurations. The flaw has been patched in Password Manager Pro version 13235, PAM360 version 8561, and Access Manager Plus version 4405, released on July 7, 2026.

Affected products

Zohocorp Password Manager Pro before 13235
Zohocorp PAM360 before 8561
Zohocorp Access Manager Plus before 4405

Timeline

2026-09-02: disclosed: CVE-2026-14828 published
2026-07-07: patched: Fixed versions released: Password Manager Pro 13235, PAM360 8561, Access Manager Plus 4405

References

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-14828.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.