CVE-2022-35405

What it actually does

CVE-2022-35405 is a remote code execution vulnerability in Zoho ManageEngine Password Manager Pro, PAM360, and Access Manager Plus caused by unsafe deserialization in exposed application functionality. In Password Manager Pro versions before 12101 and PAM360 versions before 5510, the flaw is remotely exploitable without authentication over the network. In Access Manager Plus versions before 4303, exploitation requires authentication. A successful exploit allows attacker-controlled serialized data to be processed by the Java application, resulting in arbitrary command execution with the privileges of the ManageEngine service account. Because these products manage privileged credentials and access workflows, compromise can expose stored secrets, administrative sessions, integrations, and the underlying server.

Why it matters to the business

Successful exploitation can give an attacker direct control of a privileged access management system, potentially exposing passwords, secrets, administrative credentials, SSH keys, service accounts, and access workflows used across the organization. The vulnerability has a CVSS score of 9.8, an EPSS score of 0.9994, is listed in CISA KEV, and has been observed exploited in the wild, so internet-exposed or unpatched deployments should be treated as high-priority compromise risks. Operational consequences can include credential theft, lateral movement, privilege escalation, disruption of privileged access services, regulatory exposure, and the need for broad credential rotation after remediation.

How an attack unfolds

An attacker first identifies an exposed ManageEngine Password Manager Pro, PAM360, or Access Manager Plus instance and fingerprints its version or reachable application endpoints. For Password Manager Pro and PAM360, the attacker can send a crafted unauthenticated network request containing malicious serialized Java content to vulnerable application functionality. For Access Manager Plus, the attacker must first obtain valid credentials and then send the malicious request. When the vulnerable server deserializes the attacker-controlled object, it can invoke code paths that execute operating-system commands under the Java application service account. The attacker commonly uses this initial execution to run shell commands, stage a web shell or remote access tool, download additional payloads, enumerate stored credentials, access application databases or configuration files, and pivot using secrets managed by the product. Because this vulnerability is in CISA KEV and has active in-the-wild exploitation, historical exposure should be investigated even after patching.

How to fix it

Upgrade affected products to fixed versions or later: ManageEngine Password Manager Pro 12101 or later, ManageEngine PAM360 5510 or later, and ManageEngine Access Manager Plus 4303 or later. If immediate upgrade is not possible, restrict access to the application to trusted administrative networks or VPNs, block direct internet exposure, and apply vendor-recommended mitigations. Because this is a known exploited vulnerability affecting privileged access management systems, remediation should include incident review, not just patching. After patching, rotate credentials and secrets that may have been stored in or accessible from the affected product, especially if the instance was internet-exposed, unpatched after publication, or showed suspicious activity. Ensure the ManageEngine service account runs with least privilege and that administrative interfaces are protected with MFA, network allowlisting, and centralized logging.

How to confirm the fix worked

Confirm the installed product build is at or above the fixed version: Password Manager Pro 12101, PAM360 5510, or Access Manager Plus 4303. Validate using the product UI, build information files, package inventory, or vendor-supported version commands rather than relying only on host naming or patch records. Verify that internet-facing scanning no longer identifies vulnerable versions or exposed vulnerable endpoints. Review web access logs to confirm that unauthenticated access to sensitive application endpoints is not possible and that access is restricted to expected administrative sources. For higher assurance, perform an authenticated configuration review, external attack-surface scan, and vulnerability scan using a plugin that explicitly checks for CVE-2022-35405 or the relevant fixed build numbers. After upgrade, confirm the application starts cleanly, logs do not show deserialization or XML-RPC errors from suspicious sources, and no unexpected web shells, startup scripts, scheduled tasks, or child processes remain on the host.

Typical attack path

1. Scan the internet or internal networks for exposed Zoho ManageEngine Password Manager Pro, PAM360, or Access Manager Plus services.
2. Fingerprint the product and version or test for vulnerable endpoints associated with the ManageEngine application.
3. For Password Manager Pro and PAM360, send a crafted unauthenticated request containing malicious serialized Java data; for Access Manager Plus, authenticate first and then send the malicious request.
4. Trigger unsafe deserialization inside the Java application, causing attacker-supplied commands to execute on the server.
5. Establish persistence or interactive access by dropping a web shell, reverse shell, scheduled task, service, or remote access tool.
6. Enumerate application configuration, database connection details, stored secrets, privileged accounts, SSH keys, and integrations.
7. Use recovered credentials or tokens for lateral movement into other systems.
8. Delete, modify, or blend into logs to reduce evidence of exploitation.

How to detect it

Investigate whether exploitation occurred by correlating ManageEngine application logs, web access logs, reverse proxy logs, EDR process telemetry, operating-system security logs, file integrity data, and outbound network connections. Focus on requests to XML-RPC or deserialization-related endpoints, especially unauthenticated POST requests from unknown external IP addresses, unusually large request bodies, Java serialized-object markers, or errors referencing XML-RPC, deserialization, class loading, invocation, or process execution. On the host, look for child processes spawned by the ManageEngine Java process; privileged access management servers normally should not spawn shells, PowerShell, curl, wget, certutil, msiexec, or scripting engines as a result of web requests. Review product installation directories for recently created or modified JSP files, WAR/JAR files, scripts, binaries, and files in temporary upload or working directories. Check for suspicious outbound connections shortly after inbound requests, especially reverse shells, downloads from paste sites or file-sharing infrastructure, and connections to rare external IPs. In Windows environments, review Event ID 4688, Sysmon Event ID 1, service creation events, scheduled task creation, and PowerShell logs. In Linux environments, review shell history where available, auditd process execution, cron modifications, systemd service changes, and web/app server write locations. Because this is a privileged credential system, also review application audit logs for secret exports, mass credential access, new administrative users, integration changes, and unexpected authentication activity after the suspected exploitation window.

• POST /xmlrpc
• /xmlrpc
• rO0AB
• aced0005
• java.lang.ProcessBuilder
• java.lang.Runtime
• org.apache.xmlrpc
• XmlRpcException
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• msiexec.exe /i
• /bin/sh -c
• bash -c
• curl http
• wget http
• ManageEngine/PasswordManagerPro/logs
• ManageEngine/PAM360/logs
• ManageEngine/AccessManagerPlus/logs
• .jsp
• webapps/ROOT
• serverout0.txt
• access_log

What your security team should do

• Treat unpatched or previously internet-exposed instances as potentially compromised because the vulnerability is in CISA KEV, has active exploitation, and has an EPSS score near 1.0.
• Immediately upgrade Password Manager Pro to 12101 or later, PAM360 to 5510 or later, and Access Manager Plus to 4303 or later.
• Remove direct internet exposure for privileged access management systems; restrict access to trusted administrative networks, VPN, or zero-trust access controls.
• Review historical logs from at least the date of first exposure through the patch date for suspicious requests, Java deserialization indicators, unexpected command execution, web shells, and outbound connections.
• Hunt for child processes spawned by the ManageEngine Java process, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, bash, sh, curl, wget, certutil, msiexec, or python.
• Rotate passwords, API keys, SSH keys, service account credentials, and other secrets stored in or integrated with the affected product if compromise cannot be confidently ruled out.
• Inspect application directories for newly created JSP files, modified web application files, unfamiliar JAR files, or recently changed scripts.
• Enable centralized logging for web access logs, application logs, operating-system process creation, EDR telemetry, and outbound network connections from the ManageEngine server.
• Run the ManageEngine service with least privilege and monitor for anomalous access to credential vault data or bulk export activity.
• Document KEV remediation status; the CISA due date for federal remediation was 2022-10-13, so any remaining vulnerable deployment is significantly overdue.