CVE-2026-14828

State: Published
Severity: 8.8 High
Published: Sep 2, 2026
Updated: Sep 3, 2026
Reserved: Jul 6, 2026

Description

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Zohocorp

Weaknesses

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Affected Products

Product	Versions
ManageEngine Password Manager ProZohocorp	before 13235Affected
ManageEngine PAM360Zohocorp	before 8561Affected
ManageEngine Access Manager PlusZohocorp	before 4405Affected

References

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-14828.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.