Loading story…
Researchers detailed how CVE-2022-35405, a pre-authentication remote code execution flaw in Zoho/ManageEngine Password Manager Pro, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects.
After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a single point of failure: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching Domain Admin in enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Shielder described a red-team assessment in which an internet-exposed ManageEngine Password Manager Pro instance was exploited via CVE-2022-35405, after which the team reverse engineered the product's encryption to recover the database password, master key, and plaintext managed credentials. The write-up concluded that compromise of the PMP server could enable full credential recovery and escalation to Domain Admin.
A reference discusses the Zoho/ManageEngine Password Manager Pro XML-RPC pre-authentication remote code execution vulnerability tracked as CVE-2022-35405. The source was published on 2022-08-01, but the content provided does not explicitly anchor the underlying disclosure event to a specific date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
shielder.com
Open sourcexz.aliyun.com
Open sourcecheatsheetseries.owasp.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-wide scanning identified **6,000+ SmarterTools SmarterMail** servers exposed online and likely vulnerable to **CVE-2026-23760**, a **critical authentication bypass** in the password reset API that enables **unauthenticated admin account takeover** and can lead to **remote code execution**. The flaw affects SmarterMail versions prior to **build 9511** and abuses the `/api/v1/auth/force-reset-password` (aka `force-reset-password`) endpoint, which allows anonymous password resets for administrator accounts without validating the existing password or requiring a reset token. SmarterTools issued a fix on **January 15, 2026** (later assigned CVE-2026-23760), and Shadowserver reported large-scale exposure with thousands of instances flagged as “likely vulnerable,” including heavy concentration in North America and additional exposure in Asia. Multiple sources reported **active exploitation** shortly after patch availability, with observed attacker behavior consistent with automated hijacking: resetting admin credentials, obtaining authenticated access, and then leveraging SmarterMail administrative capabilities to execute OS-level commands. Huntress reported attackers creating malicious **System Events** to run reconnaissance commands and establish persistence, while watchTowr (which reported the issue to SmarterTools) received additional reports of exploitation in production environments. The reporting also notes this disclosure follows closely after another critical pre-auth SmarterMail issue (**CVE-2025-52691**), reinforcing that unpatched, internet-exposed SmarterMail deployments are being actively targeted.
Jun 29, 2026
Active in-the-wild exploitation of **SolarWinds Web Help Desk (WHD)** vulnerabilities is being used to achieve **remote code execution (RCE)** on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via `wrapper.exe` spawning `java.exe` in the Tomcat-based application), where attackers executed `cmd.exe` to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (`esmahyft@proton[.]me`). The activity is linked to recently disclosed WHD issues, including **CVE-2025-40551** (untrusted deserialization leading to code execution, added to **CISA KEV**) and **CVE-2025-26399**, which multiple vendors have cited as being exploited in the wild. Post-compromise, the actor used the Zoho RMM process (`TOOLSIQ.EXE`) as an operational foothold to run **Active Directory discovery** and domain enumeration (e.g., `net group "domain computers" /do`) consistent with preparation for lateral movement. The intrusions also included deployment of **Velociraptor** for endpoint control and collection, and use of **Cloudflare tunnels** to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Jun 29, 2026
A critical unauthenticated SQL injection vulnerability, tracked as CVE-2025-8324 with a CVSS score of 9.8, has been identified in Zoho Analytics Plus (also known as Zohocorp ManageEngine Analytics Plus) versions 6170 and below. This flaw arises from improper filter configuration, allowing remote attackers to exploit the vulnerability without authentication, potentially leading to full data takeover and exposure of sensitive information. Security advisories emphasize the severity of this issue, highlighting the risk of unauthorized access and manipulation of analytics data. Organizations using affected versions are urged to apply available patches or mitigations immediately to prevent exploitation, as the vulnerability is remotely exploitable and could be leveraged in targeted attacks against enterprise environments relying on Zoho Analytics Plus for business intelligence and reporting.
Jun 29, 2026