Brief Summary: CVE-2026-5785 Authenticated SQL Injection in ManageEngine Password Manager Pro and PAM360

Introduction

An authenticated SQL injection in ManageEngine's privileged access management products lets a user with a low-privilege auditor role decrypt stored credentials and escalate to full administrative control. For organizations relying on Password Manager Pro or PAM360 as their enterprise credential vault, this vulnerability effectively turns a read-oriented auditor account into a skeleton key for the entire password repository.

ManageEngine, a division of Zoho Corporation, makes enterprise IT management software used by organizations worldwide. Password Manager Pro and PAM360 are privileged access management (PAM) products built to secure, store, and manage sensitive credentials and secrets across an enterprise. Because these products sit at the center of an organization's security infrastructure, a flaw in either one puts the credentials they protect at risk.

Technical Information

CVE-2026-5785 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. It has a CVSS score of 8.1, which puts it in the high-severity range.

Root Cause

The flaw is in the Query Reports module of both Password Manager Pro and PAM360. This module lets users pull specific data from the application's repository by writing custom SQL queries. It also supports decryption natively. Users can call a decrypt function on encrypted columns, which the database schema identifies with the SCHAR data type.

The root cause is insufficient input sanitization in the Query Reports module. When a user with the Password Auditor role submits a custom query, the application does not properly validate and sanitize the SQL input before running it against the backend database. That lets an attacker break out of the intended query boundary and execute arbitrary SQL statements.

Attack Flow

Based on the advisory details, exploitation follows this sequence:

1. Initial Access: The attacker authenticates to the ManageEngine application with a valid account that holds the Password Auditor role. Password Auditor is a legitimate, low-privilege role meant for compliance and reporting.

2. SQL Injection via Query Reports: The attacker opens the Query Reports module and writes a malicious SQL query. Because the module accepts user-constructed SQL and the application does not properly sanitize it, the attacker can inject arbitrary SQL commands.

3. Data Exfiltration and Decryption: The attacker uses the module's built-in decrypt function to read and decrypt sensitive columns (those with the SCHAR data type) from the backend database, which exposes the stored credentials in plaintext.

4. Privilege Escalation: With access to the underlying database and the ability to execute arbitrary SQL, the attacker modifies their own role or creates a new account with Privileged Administrator permissions. At this point, the attacker has full administrative control over the PAM product.

Pairing SQL injection with the application's own decryption feature is what gives this vulnerability its reach. The attacker never has to break the encryption from outside, because the Query Reports module decrypts the data for them.

Patch Information

Zohocorp has released upgrade packs for both affected products that fix the authenticated SQL injection in the Query Reports module. Both products are closed-source enterprise applications, so no public code diffs are available.

PAM360 got its fix first. Build 8531 shipped on April 2, 2026, just five days after the vulnerability was reported to the vendor on March 28, 2026. Password Manager Pro followed with build 13231 on April 7, 2026. Both sets of release notes describe the fix in the same words: an SQL injection vulnerability was identified and fixed.

The Password Manager Pro 13231 hotfix also bundles a separate fix for a remote code execution (RCE) vulnerability in a third-party package, so upgrading to this build addresses two distinct security issues at once.

The fix applies proper validation and sanitization of user-supplied input in the Query Reports module. That closes the SQL injection vector and prevents escalation from Password Auditor to Privileged Administrator.

Upgrade Procedure

Before applying the upgrade packs, administrators must back up the complete installation folder and store the copy in a separate location. If the deployment uses Microsoft SQL Server as its backend database, they must also take a full database backup before upgrading. After the upgrade completes successfully, administrators should delete these backups.

Download the latest upgrade packs from the vendor's official pages:

• Password Manager Pro: Upgrade Pack
• PAM360: Upgrade Pack

Affected Systems and Versions

The following product versions are confirmed vulnerable:

• ManageEngine Password Manager Pro: Versions 8600 through 13230
• ManageEngine PAM360: All versions up to and including 8530

Organizations running any version in these ranges should upgrade to the fixed builds (Password Manager Pro 13231 or PAM360 8531) as soon as possible.

Vendor Security History

ManageEngine's PAM360 and Password Manager Pro product lines have a documented pattern of SQL injection vulnerabilities over the past several years:

• CVE-2024-5546: SQL injection, fixed in version 7001 on June 14, 2024
• CVE-2022-47523: SQL injection, fixed in version 5801 on December 28, 2022
• CVE-2022-43671 and CVE-2022-43672: SQL injection flaws, fixed in version 5711 on October 22, 2022
• CVE-2022-40300: SQL injection, fixed in version 5600 on September 11, 2022

With SQL injection fixes landing in 2022, 2024, and now 2026, organizations using these products should keep strict patch management practices in place and continuously monitor ManageEngine's security advisories.

References

• NVD Entry for CVE-2026-5785
• ManageEngine Advisory for CVE-2026-5785
• ManageEngine PAM360 Issues Fixed
• Password Manager Pro Release Notes
• PAM360 Release Notes
• ManageEngine Community Advisory for Password Manager Pro
• Query Reports Documentation
• Password Manager Pro Upgrade Pack
• PAM360 Upgrade Pack
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command