CVE-2026-12263
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
Risk Assessment
Risk includes unauthorized access to the password management system, potentially leading to exposure of credentials.
Recommendation
Upgrade Password Manager Pro to version 13232 or later and PAM360 to version 8551 or later.
Other vulnerabilities in ManageEngine Password Manager Pro
See all- CVE-2016-1161High
CVE-2016-1161 is a Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before version 8.5 (Build 8500).
- CVE-2026-14828High
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
- CVE-2026-11840High
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
Original NVD description (English source)
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS