Zoho ManageEngine Password Manager Pro, PAM360, and Access Manager Plus Remote Code Execution (RCE) Vulnerability (CVE-2022-35405) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTZoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303
Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests
Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official service pack provided by the vendor. Below is an example of the backup and upgrade process on a Linux environment.
# 1. Stop the ManageEngine service
cd /opt/ManageEngine/PMP/bin
./shutsdown.sh
# 2. Backup the database and installation directory
tar -czvf /backup/PMP_backup_$(date +%F).tar.gz /opt/ManageEngine/PMP
# 3. Apply the latest upgrade pack using UpdateManager
./UpdateManager.sh -c2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict external access to the vulnerable XML-RPC endpoint ('/xmlrpc') using a web application firewall (WAF) or reverse proxy. For Nginx, apply the following configuration:
# Block external access to the XML-RPC endpoint
location /xmlrpc {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Inspect the application logs to identify potential exploitation attempts or unauthorized XML-RPC requests.
# Search for XML-RPC requests in access logs
grep -i 'xmlrpc' /opt/ManageEngine/PMP/logs/access_log.*
# Check for deserialization errors or exceptions in wrapper logs
grep -i -E 'ObjectInputStream|XML-RPC' /opt/ManageEngine/PMP/logs/wrapper.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-35405) is a Java deserialization vulnerability (CWE-502) residing in the XML-RPC interface of Zoho ManageEngine products. The root cause is the unsafe deserialization of untrusted user input without proper validation, allowing attackers to execute arbitrary code via crafted serialized objects.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted XML payload to the XML-RPC servlet endpoint. This payload contains a Base64-encoded serialized Java object containing a gadget chain (such as Commons-Beanutils). When the server processes and deserializes this request, the embedded OS commands are executed within the context of the JVM. For Password Manager Pro and PAM360, this endpoint is accessible without authentication, making it highly exploitable.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Since these products manage enterprise credentials, a successful compromise allows attackers to harvest sensitive credentials, move laterally across the network, and potentially achieve full domain compromise.
Official Vendor Advisories & References
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Frequently Asked SecOps Questions (CVE-2022-35405)
FAQQ1. How critical is CVE-2022-35405 and is it actively exploited in the wild?
CVE-2022-35405 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-35405?
Primary impacted vendors include zoho across manageengine password manager pro, manageengine pam360, manageengine access manager plus. Scope summary: ManageEngine Password Manager Pro before 12101 (unauthenticated), PAM360 before 5510 (unauthenticated), and Access Manager Plus before 4303 (authenticated)
Q3. What temporary mitigations or workarounds exist for CVE-2022-35405 before patching?
[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-35405
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zoho)
View Category →JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.