Loading vulnerability…
CVE-2022-35405 is an unauthenticated remote code execution vulnerability affecting Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510. ManageEngine Access Manager Plus before 4303 is also affected, though exploitation there requires authentication. The flaw is in the XML-RPC handler, which accepts attacker-supplied Java serialized objects and deserializes them insecurely. This unsafe deserialization condition allows a remote attacker to trigger gadget chains present in the application environment and achieve arbitrary command execution on the target server. In deployments of Password Manager Pro, successful compromise is especially severe because the application performs server-side decryption of managed secrets, making the server a high-value trust anchor for stored credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python proof-of-concept exploit for CVE-2022-35405, targeting unauthenticated remote code execution vulnerabilities in ManageEngine PAM360, Password Manager Pro, and Access Manager Plus. The exploit requires the attacker to provide the target URL, port, a path to ysoserial.jar, and a command to execute. The script generates a malicious Java serialized payload using ysoserial (CommonsBeanutils1 gadget), encodes it in base64, and sends it to the target's /xmlrpc endpoint via an HTTP POST request. If successful, the specified command is executed on the target server. The README provides usage instructions, affected product versions, and default ports. The exploit is operational and requires network access to the vulnerable service and the ysoserial tool for payload generation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting ManageEngine Password Manager Pro that is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation.
A critical pre-authentication remote code execution vulnerability in ManageEngine Password Manager Pro, caused by insecure deserialization in the XML-RPC handler, allowing arbitrary code execution by sending a crafted Java serialized object.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.