CVE-2026-14828 in Access Manager Plus
Summary
by MITRE • 09/02/2026
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw represents a critical authentication bypass mechanism affecting multiple products within the ManageEngine suite of identity and access management solutions, specifically Password Manager Pro prior to version 13235, PAM360 prior to version 8561, and Access Manager Plus prior to version 4405. This vulnerability is classified as an authenticated SQL Injection, which distinguishes it from more common unauthenticated injection flaws by requiring the attacker to first establish a valid session with the application. The presence of authentication does not mitigate the severity of this issue; rather, it indicates that any user account with access to the administrative or operational interface can exploit this weakness. In enterprise environments where these tools are deployed as central hubs for credential management and privileged access control, an authenticated attacker could leverage their existing permissions to escalate privileges significantly, potentially gaining full control over the underlying database infrastructure.
The technical root cause of this vulnerability lies in the improper sanitization of user-supplied input within specific API endpoints or web application parameters before they are concatenated into SQL queries executed by the backend database engine. When a legitimate user submits data through the interface, such as search terms, filter criteria, or configuration updates, the application fails to adequately validate or escape special characters that hold syntactic meaning in Structured Query Language. This allows an attacker to inject malicious SQL statements that alter the logic of the original query. By manipulating these inputs, an adversary can bypass intended access controls, extract sensitive data from database tables containing passwords and security tokens, modify existing records, or even execute administrative commands on the server hosting the database if the application runs with elevated privileges such as db_owner or sa rights in Microsoft SQL Server environments.
The operational impact of this vulnerability is severe due to the nature of the software involved. Password Manager Pro serves as a vault for storing and managing credentials across an organization, meaning that successful exploitation could lead to the mass exfiltration of usernames, passwords, SSH keys, and other sensitive authentication materials. This compromise undermines the core purpose of privileged access management solutions, which is to secure high-value assets against unauthorized use. Furthermore, because PAM360 and Access Manager Plus are integral to auditing and controlling administrative access, an attacker could manipulate audit logs to cover their tracks or alter access policies to maintain persistent backdoor entry points within the network. The ability to execute arbitrary SQL commands also poses a risk of data integrity loss, where critical configuration settings or historical records can be corrupted or deleted, leading to service disruption and potential regulatory non-compliance regarding data protection standards such as GDPR or HIPAA if personal identifiable information is exposed.
From a threat intelligence perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, which remains one of the most prevalent and dangerous web application vulnerabilities according to industry standards. The exploitation path corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via database commands or T1136 Create Account if the attacker creates new administrative users through injection payloads. It also relates to T1213 Data from Information Repositories, as the primary goal is often data extraction rather than immediate system takeover. The authenticated nature of this flaw suggests that threat actors may target organizations with weak internal access controls or compromised user credentials, using these tools as a pivot point for deeper lateral movement within the corporate network.
Mitigation strategies must prioritize immediate patching to the specified safe versions mentioned in the vendor advisories. Organizations should verify their current version numbers against the thresholds of 13235 for Password Manager Pro, 8561 for PAM360, and 4405 for Access Manager Plus. In scenarios where immediate patching is not feasible due to operational constraints or testing requirements, network-level controls such as Web Application Firewalls can be configured with specific rulesets to detect and block common SQL injection patterns targeting the affected endpoints. Additionally, implementing strict input validation on client-side applications does not replace server-side sanitization but serves as an additional layer of defense. Database access should also be reviewed to ensure that the application account operates under the principle of least privilege, avoiding high-level administrative rights within the database engine itself. Regular security audits and penetration testing focused on authentication bypasses are recommended to identify similar weaknesses in other integrated systems before they can be exploited by malicious actors seeking to compromise critical identity infrastructure.