CVE-2022-35405: Zoho ManageEngine Password Manager Pro unauthenticated deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution in a credential-management product, with a CVSS score of 9.8, KEV listing and near-maximum EPSS probability.

What it is

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution via deserialization of untrusted data. Access Manager Plus before 4303 is also affected, but requires authentication. The flaw is critical because it allows code execution without credentials on internet-reachable instances of a privileged credential-management product.

Impact

An unauthenticated attacker can execute arbitrary code on the affected server, gaining control of a system that stores and brokers privileged credentials. This can lead to theft of managed secrets and lateral movement into connected infrastructure.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), and the public exploit reference describes an XML-RPC Java deserialization path. For Password Manager Pro and PAM360 no authentication is needed; Access Manager Plus requires authentication.

Exploitation

CVE-2022-35405 is listed in CISA KEV with a due date of 2022-10-13, and EPSS shows a 30-day probability of 0.99927 (99.97th percentile). Public exploit code is referenced, and CISA records no known ransomware campaign use.

What to do

• Apply the vendor updates: Password Manager Pro 12101 or later, PAM360 5510 or later, Access Manager Plus 4303 or later.
• If patching cannot be done immediately, remove direct internet exposure of these products and restrict access to trusted management networks.
• Block or restrict access to the XML-RPC endpoint at the network or reverse-proxy layer until the patch is applied.
• Rotate credentials and secrets stored in the affected product after patching, assuming possible prior compromise.
• Monitor vendor advisories for any follow-up guidance on the affected builds.

Detection

• Hunt for POST requests to XML-RPC endpoints on Password Manager Pro, PAM360 and Access Manager Plus hosts, especially from unexpected source addresses.
• Look for unexpected child processes spawned by the Java service hosting these products, such as shells or scripting interpreters.
• Review application and web server logs for deserialization errors or anomalous XML-RPC payloads preceding process creation.
• Check for outbound connections from the product server to unfamiliar hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.