ManageEngine Password Manager Pro CVE-2026-11840: mind the build

Top/Articles/ManageEngine Password Manager Pro CVE-2026-11840: mind the build

NewsPublished Aug. 13, 2026 Updated today

Table of contents

Key takeaways

A CVSS 8.8 SQL injection hits ManageEngine Password Manager Pro and PAM360. The Japanese build line differs: 13232 does not exist there, and 13234 is the fix.

ManageEngine Password Manager Pro and PAM360 — the software that companies and government bodies use to keep all of their administrator passwords in one place — have a newly published vulnerability, CVE-2026-11840. Severity 8.8: a "SQL injection" flaw that lets an attacker slip unauthorized commands into the database.

In Japan, this product is the number one privileged password management product by units shipped, with roughly 50% market share, and has held that position two years running. Earlier tallies put it in use at more than 80% of Japan's prefectural governments and more than half of the Nikkei 225 companies, and the vendor publicly reports over 9,000 licenses sold in Japan. And yet, as of this writing, not one Japanese-language article has reported this vulnerability.

And here is the point that hits operations hardest, stated up front. If you read the international coverage and come away with "update to build 13232," you are stuck in Japan. That build number does not exist in the Japanese-language edition.

The short version

The Japanese-language builds that carry the fix are build 13234 for Password Manager Pro and build 8561 for PAM360. The numbering scheme differs from the international 13232 / 8552
An attack requires a login. But this product uses a pricing model that hands out its cheapest account type in unlimited quantities
The fix itself was distributed in June 2026. The CVE identifier arrived roughly two months later, today
No reports of attacks in the wild. But this product does have a record: it was used in a real attack once, in 2022

The build to upgrade to in Japan is not the one the international guidance names

Both the vulnerability databases and the vendor's English-language advisory list the fixed versions as "Password Manager Pro 13232" and "PAM360 8552." But look at the Japanese-language release notes and neither 13232 nor 13233 exists; the build after 13231 is 13234. That is because the Japanese-language build line is shipped separately, for reasons of localization and support arrangements.

Product	Fixed build, international	Fixed build, Japanese edition	Release date in Japan
Password Manager Pro	Build 13232	Build 13234	June 23, 2026
PAM360	Build 8552	Build 8561	July 24, 2026

ZOHO Japan, the vendor's Japanese subsidiary, published a Japanese-language support article dated June 16, 2026, and the Japanese-language release notes state plainly that "an authenticated SQL injection vulnerability (CVE-2026-11840) has been fixed." It is not that the information does not exist; it is buried deep in the support pages where it is hard to find. We could not confirm any announcement in the news release section.

If all you want is to close this one vulnerability, the builds above are enough — but in practice you should go further than that. As described below, the same products have had additional vulnerabilities fixed one after another since June. The latest international builds are Password Manager Pro 13236 (July 31, 2026) and PAM360 8601 (July 30, 2026); the latest Japanese-language build is Password Manager Pro 13235 (July 16, 2026).

What this product is holding for you

This is something entirely different from a tool an employee uses to jot down their own passwords. Think of it as the safe where every spare key to the organization is kept.

Concretely, what sits inside is: the top-level (root) passwords for servers, Windows domain administrator accounts, administrator passwords for databases and network equipment, the keys servers use to talk to each other automatically (SSH keys), and the digital certificates that prove your own site is genuine. On top of that, it stores session recordings of what administrators did once they connected to critical systems.

If this is breached, the damage does not stop at "one account leaked." Credentials an attacker would otherwise have to steal one at a time are obtained all at once. And the audit trail that is supposed to record the act sits in the very same place. Whoever opens the safe gets to walk out with the security camera footage as well.

In Japan, published customer case studies include companies such as KDDI and Kakaku.com, and the product is also used by central government agencies, local governments, and educational institutions. Privileged access management as a category is a high-value target for attackers; we previously covered a takeover vulnerability found in a different privileged access management product.

Who would attack this, and what they would do

The party who can exploit this vulnerability is anyone holding a single account that can log in to this safe. It is not a hole that just anybody on the internet can hit. The realistic candidates are an attacker who got in using stolen employee credentials, someone who phished those credentials out of a user, or a person already inside the organization.

What they do is slip a crafted statement into a value entered through the interface, making the safe's database perform operations it was never meant to allow. SQL injection refers to an attack that mixes malicious strings into the commands sent to a database in order to extract or rewrite data that should not be visible. The vendor describes the impact only as the ability to "execute unintended SQL operations," and has not disclosed how far an attacker can actually get.

The shape of the damage can be inferred from the nature of what is being held. Viewing administrator passwords belonging to other people's scope, rewriting permissions, tampering with audit records. For the organization, every system downstream of that is put at risk in a chain. We previously worked through a case where an intrusion through a single VPN appliance brought a company's financial close to a halt, but a credential vault is a vital point that sits even further upstream than that.

"Requires a login" is less reassuring than you would think

Looking at the severity breakdown, the attack requires "an authenticated user with low privileges." Reading that, it is tempting to think "only administrators touch ours, so we are fine" — but with this product in particular, that premise collapses.

The reason is the pricing model. The vendor's licensing documentation states that the price is determined by the number of administrators, and that users who only view passwords, along with auditors, are unlimited in number. In other words, the design creates a commercial incentive to hand out the cheapest account type in bulk. Bulk registration by department through Active Directory integration is also supported as standard practice.

And the decisive point is a case involving the same product four months earlier. CVE-2026-5785, published in April 2026, was also a SQL injection, and here is how the vendor described it at the time.

"The SQL injection vulnerability allows an adversary with a Password Auditor role to execute custom queries, and escalate to Privileged Administrator and perform sensitive actions."

In other words, the vendor itself acknowledges that escalation from a near-bottom privilege level all the way to the top actually worked, through the same class of flaw in this same product. For CVE-2026-11840 there is no mention of escalation, and whether an attacker can get that far has not been disclosed. That said, the severity breakdown does come with "high impact to confidentiality, integrity, and availability."

In fairness, let me also note the factors that raise the bar. This product has no feature for users to create their own accounts. Unless an administrator registers them, an outsider cannot obtain an account. The vendor also states explicitly that the product is "designed on the assumption of use within an internal network." The realistic entry point is not privilege itself, but credential theft, phishing, and insiders.

Three flaws of the same kind in 2026 alone

Trace through the fix history the vendor publishes and a troubling sequence comes into view. Authenticated SQL injection has been fixed three times in a row since the start of 2026.

Build	When	Main content of the fix
13231	April 2026	CVE-2026-5785 (SQL injection) privilege escalation confirmed
13232	June 2026	CVE-2026-11840 (this one) plus an authentication bypass
13233	June 2026	Yet another SQL injection (no CVE assigned)
13235	July 2026	CVE-2026-14828 (SQL injection again)
13236	July 2026	CVE-2026-18199 remote code execution from low privilege

Going further back, several SQL injections of the same kind were fixed in 2022, and another one in 2024. For this product, SQL injection should be seen not as a one-off accident but as a chronic weakness. Of the case fixed in 2022 in particular, the vendor explained that it "allows all Password Manager Pro users access to the backend database."

What cannot be overlooked is the content of build 13236, at the bottom of that table. Remote code execution by a low-privileged user, inadequate access control over SSH keys and private keys, an authorization bypass. Things distinctly heavier than this CVE were fixed at the end of July. This is why the correct decision is not "respond to CVE-2026-11840" but "go all the way up to the latest build". Note that CVE-2026-14828 and CVE-2026-18199 are not yet registered in the vulnerability databases as of this writing; the vendor has merely published the numbers.

This product has a record of being attacked in the wild

CISA, the US government agency, publishes a catalog of vulnerabilities confirmed to have been used in real attacks. Nine ManageEngine vulnerabilities are listed there, and one of them belongs to the very same Password Manager Pro / PAM360 (CVE-2022-35405, added September 2022).

The vendor's products were targeted before that as well. In 2021, CISA, the FBI, and the Coast Guard Cyber Command jointly issued a warning that a vulnerability in ManageEngine ADSelfService Plus was being exploited by state-sponsored actors. The technique involved planting malware disguised as a certificate file, stealing administrator credentials, and carrying off the Active Directory files themselves. In Japan, JPCERT/CC issued an alert as well.

This part, though, has to be written fairly. All nine listed entries were assigned between 2019 and 2022, and the most recent addition to the list was in March 2023. Not a single ManageEngine vulnerability assigned in 2023 or later has been confirmed as exploited in the wild. The assessment that "ManageEngine is an easy target" rests on fact, but that fact is mainly about 2021 through 2023, and applying it directly to this 2026 case is a leap of logic.

There is still a number worth referencing. The 2022 vulnerability in this same product reached an estimated exploitation probability of 99.94%. It is worth keeping in mind that holes in this product get used once they become public — there is a track record for it. On this site we also publish a dashboard for browsing this exploitation catalog in Japanese.

Is it under attack right now?

✓ Confirmed facts

✓Not listed in CISA's exploitation catalog. Checked against version 2026.08.11, all 1,665 entries (no Zoho product vulnerability assigned in 2026 appears in it)
✓No publicly released code reproducing the attack has been confirmed
✓No reports of attacks in the wild, nor of use in ransomware
✓The fix was distributed in June 2026. The CVE identifier was published roughly two months later, on August 13
✓The vendor credits the reporter under the name "duypnh"

? Not yet known

?Technical details — which screen and which input field are affected, the vendor has disclosed nothing at all
?Whether escalation to the highest privilege level is possible, as it was in the April case
?The estimated probability of attack within the next 30 days — not yet calculated, as this is the day of publication
?Whether the fixed PAM360 build is 8551 or 8552 — the vendor's own documents contradict each other
?Whether Access Manager Plus is affected — the current advisory says nothing about it

No workaround has been offered. The vendor's guidance is to apply the update pack, and nothing else.

Outside the vendor's support pages, there is no Japanese-language information

JVN, JVN iPedia, JPCERT/CC, IPA. This CVE appears nowhere in Japan's public vulnerability information channels. Neither Security NEXT nor ScanNetSecurity has reported it. Internationally, major outlets such as BleepingComputer and The Register have not covered it either.

For a product with roughly 50% market share in Japan, holding an organization's entire set of credentials, that silence is out of proportion. The reason is presumably that the fix was already distributed two months ago, and at that point no identifier had been assigned. When the convention is to report only after a number exists, whole cases drop out like this.

For what it is worth, JVN iPedia does cover this product family on an ongoing basis and listed a different vulnerability in February 2026. It may well pick this case up eventually, but while you wait for that, the fix has been in your hands for two months already.

What to do

If you are running the Japanese-language edition, move to Password Manager Pro build 13234 or later, and PAM360 build 8561 or later. As noted above, however, additional vulnerabilities have been fixed one after another since June, so in practice the sensible move is to go up to the latest build available to you. Application is done with the update pack the vendor distributes.

If you are running the international edition as-is, Password Manager Pro 13236 and PAM360 8601 are the latest at present. Confirm first whether you are on the Japanese-language edition or the international one. Because the numbering schemes are separate, getting this wrong leaves you with either "we updated and it still is not fixed" or an endless search for a build number that does not exist.

On the operational side, there is one more thing worth checking: how many accounts can log in to this safe right now. Because view-only users can be added without any limit on headcount, the structure makes it easy for accounts to linger after transfers and departures. Given that the precondition for this vulnerability is "somebody who can log in," tidying up unused accounts translates directly into a smaller attack surface.

Summary

A SQL injection flaw rated 8.8 has been published for ManageEngine Password Manager Pro and PAM360. The attack requires a login, but this product uses a pricing model that allows unlimited view-only users, and in the same class of flaw four months ago, escalation from a near-bottom privilege level to the very top was demonstrated. "It is authenticated, so we are safe" does not hold.

For users in Japan, the single most important thing is that the build number you need to reach differs from the international guidance. Password Manager Pro is 13234; PAM360 is 8561. The 13232 and 8552 written for the international audience do not exist in the Japanese-language edition. And because further vulnerabilities have kept coming since June, going up to the latest build is the sure approach.

No attack in the wild has been confirmed yet. But this product was used in a real attack once, in 2022, and is listed in CISA's exploitation catalog for it. A safe holding every spare key to the organization is a place that will always be tried once a hole becomes public. Roughly 50% market share in Japan means, turned around, that for an attacker looking to target Japan this is the first product to look at.

References

Makoto Horikawa

Backend Engineer / AWS / Django