CVE-2022-47523: Zoho ManageEngine PAM products SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a very high EPSS score, makes this an urgent patch for internet-exposed PAM deployments.

What it is

Zoho ManageEngine Access Manager Plus, Password Manager Pro and PAM360 contain a SQL injection flaw fixed in versions 4309, 12210 and 5801 respectively. Because these are privileged access management products, a successful injection can expose or alter the credential vault data they are meant to protect.

Impact

An unauthenticated attacker can read, modify or destroy data in the underlying database, potentially including stored privileged credentials and session records. Full loss of confidentiality, integrity and availability of the application is possible.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The specific vulnerable endpoint or parameter is not described in the record.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.706 (99.4th percentile), indicating elevated likelihood of attempted exploitation. The only references are the vendor patch advisories, so no public exploit code is confirmed by this record.

What to do

• Upgrade Access Manager Plus to 4309 or later, Password Manager Pro to 12210 or later, and PAM360 to 5801 or later.
• If immediate patching is not possible, restrict network access to these PAM web interfaces to trusted management networks only.
• Review database and application logs for anomalous SQL activity against the PAM instances.
• Rotate privileged credentials stored in the affected products as a precaution if compromise is suspected.
• Confirm no unauthorized administrative accounts or configuration changes were created in the PAM platform.

Detection

• Search web and database logs for SQL metacharacters or UNION/boolean patterns in requests to the PAM application.
• Alert on unexpected database queries or errors originating from the PAM application service account.
• Monitor for new or modified accounts, roles or vault entries in Access Manager Plus, Password Manager Pro and PAM360.
• Correlate outbound connections from PAM hosts to unfamiliar destinations that could indicate data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.