CVE-2026-14828
Received Received - Intake

Authenticated SQL Injection in Zoho ManageEngine Password Manager Pro

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: ManageEngine

Description
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-14828
EUVD
EUVD-2026-69888

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zohocorp manageengine_password_manager_pro to 13235 (exc)
zohocorp pam360 to 8561 (exc)
zohocorp access_manager_plus to 4405 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14828 is a high-severity SQL injection vulnerability affecting Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus. The flaw allows authenticated attackers to execute malicious SQL queries on the database.

Detection Guidance

To detect this vulnerability, check the installed versions of Password Manager Pro, PAM360, or Access Manager Plus against the affected releases (up to 13234, 8560, and 4404 respectively). Use commands like 'rpm -qa | grep PasswordManagerPro' or 'dpkg -l | grep pam360' to verify versions. Monitor database logs for unusual SQL queries or errors indicating injection attempts.

Impact Analysis

This vulnerability can lead to unauthorized data access, modification, or deletion in the affected applications. Attackers could extract sensitive information, manipulate records, or disrupt services if they gain authenticated access.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately upgrade to the latest versions: Password Manager Pro 13235, PAM360 8561, or Access Manager Plus 4405. Download the updates from the official ManageEngine advisory links. Ensure backups are taken before upgrading. Restrict database access and review user permissions to limit potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart