CVE-2022-35405: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

CVE-2022-35405 is a remote code execution vulnerability affecting certain Zoho ManageEngine products: PAM360, Password Manager Pro, and Access Manager Plus. It stems from CWE-502, deserialization of untrusted data, and allows an attacker to execute code on the target system. These tools manage privileged access and credentials, so successful exploitation can give an adversary deep control over enterprise identity and access infrastructure. Confirm all product-specific details against the vendor advisory.

IT and security teams should treat this as a high-priority issue because the products often sit at the center of privileged-account workflows. Public detail on exact attack paths is limited; the CISA summary simply notes an unspecified vulnerability that enables remote code execution. Apply updates per vendor instructions as the primary response.

How it works

CWE-502 occurs when an application deserializes data from an untrusted source without sufficient validation. In products of this class, serialized objects may be accepted over network interfaces that handle authentication, session, or configuration data. An attacker who can supply a crafted serialized payload can cause the application to instantiate unexpected objects, leading to arbitrary code execution in the context of the service account.

The vulnerability is remote, so the attacker does not need prior local access. Exact request formats, endpoints, or authentication requirements are not specified in the available summary; treat any network-reachable instance of the listed products as potentially exposed until the vendor advisory is reviewed. Because the products manage passwords and privileged sessions, code execution can immediately yield credential theft or lateral movement.

Am I affected? How to find it in your systems

These Zoho ManageEngine products typically run as on-premises or self-hosted servers used by IT and security operations teams for privileged access management, password vaulting, and access control. Inventory efforts should focus on servers and virtual machines that host PAM360, Password Manager Pro, or Access Manager Plus.

• Search asset inventories, CMDB records, and software deployment tools for the product names.
• Check listening ports and process lists on management servers for ManageEngine-related services.
• Review configuration management and patch-management reports for installed versions of the three products; compare them against the fixed versions listed in the vendor advisory.
• Examine network diagrams and firewall rules for any external or internal exposure of the management interfaces.

Log and telemetry signs of exploitation are not detailed in the public summary. Look for anomalous process creation, unexpected outbound connections, or deserialization-related exceptions in application logs. Correlate any such activity with authentication events around the time of suspected access. Confirm exact indicators against the vendor advisory and any subsequent threat-intelligence updates.

How to remediate

Patch first. Apply the updates published by Zoho for PAM360, Password Manager Pro, and Access Manager Plus exactly as directed in the vendor advisory. CISA’s required action is simply to apply updates per vendor instructions; follow that guidance without delay.

• Schedule maintenance windows for the affected hosts and verify successful installation of the vendor-supplied patches.
• After patching, restart services as required and confirm the new version numbers match the fixed releases.
• For the broader class of deserialization weaknesses, ensure that any remaining untrusted input paths are hardened: reject unexpected content types, enforce strict schema validation, and prefer safer serialization formats where the product allows configuration.
• Review and rotate any privileged credentials that were stored or managed by the affected instances, especially if the systems were internet-facing or showed signs of compromise.

If you can't patch immediately

Until the vendor updates can be applied, reduce the attack surface with compensating controls.

• Segment the hosts: place them behind strict network access controls so that only authorized administrative subnets can reach the management interfaces.
• Disable or restrict any optional remote-access or API features that are not required for daily operations, if the product configuration permits it.
• Deploy virtual patching or WAF rules that block known deserialization payload patterns or anomalous request sizes and content types associated with this class of flaw; tune carefully to avoid false positives.
• Increase monitoring: enable detailed application and system logging, forward logs to a SIEM, and alert on process spawning, unusual file writes, or unexpected network connections originating from the ManageEngine services.
• Limit the privileges of the service accounts under which the products run so that any successful code execution has reduced impact.

These measures lower risk but do not eliminate it; schedule the official patch as soon as possible.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities can lead to full system compromise and subsequent data breaches. Although ransomware use is not documented for this CVE, any successful exploitation of a privileged-access management platform can expose credentials, session data, and other sensitive material. Review logs for signs of unauthorized access, rotate affected credentials, and investigate downstream systems that trust the ManageEngine instance. You can also run a free exposure scan of your email addresses to check whether they appear in known breach data sets, which may help identify secondary impact.