CVE-2022-29081: Zoho ManageEngine PAM products access-control bypass via path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, high EPSS, and public exploit detail against internet-facing privileged-access-management systems.

What it is

Zoho ManageEngine Access Manager Plus, Password Manager Pro and PAM360 fail to enforce access control on several REST API endpoints (SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvents, Synchronize) when the request path contains the ../RestAPI substring. Because these are privileged PAM components, bypassing authentication exposes credential vault and session-management functionality. The flaw is rated CVSS 9.8 critical and has a very high EPSS score, so it warrants urgent attention.

Impact

An unauthenticated remote attacker can reach REST API functionality that should require authentication, potentially reading or manipulating privileged-access-management data such as managed credentials and session records. The full scope of what each endpoint exposes is not detailed in the record.

Attack surface

Reachable over the network through the affected REST API URLs; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. The bypass is triggered by including the ../RestAPI substring in the request path.

Exploitation

Not listed in CISA KEV, but EPSS is 0.835 (99.7th percentile) and a Tenable research reference is tagged Exploit, indicating public exploit detail exists. No ransomware association is documented.

What to do

• Upgrade Access Manager Plus to 4302 or later, Password Manager Pro to 12007 or later, and PAM360 to 5401 or later.
• If immediate patching is not possible, restrict network access to the PAM web/REST interfaces to trusted management networks only.
• Block or normalize request paths containing ../RestAPI at the reverse proxy or WAF and reject traversal sequences.
• Audit PAM logs for unexpected REST API calls to the listed endpoints and rotate any credentials that may have been exposed.

Detection

• Search web/proxy logs for requests whose URI contains ../RestAPI, especially to SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvents or Synchronize.
• Alert on unauthenticated or anomalous access to those REST endpoints from unfamiliar source IPs.
• Monitor PAM application logs for access-control or path-normalization errors tied to these endpoints.
• Correlate any successful hits with subsequent credential retrieval or configuration changes in the PAM audit trail.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.