CVE-2026-18199

Summary

Authenticated users with low privileges can execute arbitrary code on Zoho ManageEngine Password Manager Pro (before 13236) and PAM360 (before 8601) due to a remote code execution flaw, likely involving unsafe input handling in an authenticated endpoint.

Exploitability

Exploitation requires valid low-privilege credentials and network access; no public exploit is available yet.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the affected server, potentially exposing all managed credentials and enabling lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Password Manager Pro to version 13236 or later, or PAM360 to version 8601 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.