CVE-2026-11840
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
Risk Assessment
Risk includes unauthorized access to the password database, potentially leading to exposure of credentials.
Recommendation
Upgrade Password Manager Pro to version 13232 or later and PAM360 to version 8552 or later.
Other vulnerabilities in ManageEngine Password Manager Pro
See all- CVE-2016-1161High
CVE-2016-1161 is a Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before version 8.5 (Build 8500).
- CVE-2026-14828High
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
- CVE-2026-12263High
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
Original NVD description (English source)
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS