CVE-2026-5785 HIGH

CVE-2026-5785: SQL Injection

Vendor Zohocorp

Product ManageEngine PAM360

Weakness CWE-89 · SQLi

Published April 16, 2026

Last update April 17, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

Key dates

02Disclosure timeline

April 16, 2026 CVE published

April 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-5785 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2026-5785

CWE CWE-89

CVSS 8.1 / HIGH

Affected versions

Vendor Zohocorp

Product ManageEngine PAM360

Affected < 8531

Vendor Zohocorp

Product ManageEngine Password Manager Pro

Affected ≥ 8600 and ≤ 13230

CVE-2026-5785: SQL Injection

01Description

02Disclosure timeline

03References

04Related CVE