CVE-2025-11669

CWE-862 — Missing Authorization4 documents4 sources

Severity

8.1HIGH

EPSS

0.0%

top 99.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Access Manager Plus Zohocorp Manageengine Pam360 Zohocorp Manageengine Password Manager PRO

Timeline

PublishedJan 13

Description

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages6 packages

▶CVEListV5zohocorp/manageengine_access_manager_plus< 4401

▶NVDzohocorp/manageengine_access_manager_plus< 4.4+1

▶CVEListV5zohocorp/manageengine_password_manager_pro< 13221

▶NVDzohocorp/manageengine_password_manager_pro< 13.2+1

▶CVEListV5zohocorp/manageengine_pam360< 8202

Patches

Patch: www.manageengine.com ↗

🔴Vulnerability Details

CVEList

Broken Access Control↗2026-01-13

▶

GHSA

GHSA-6ffq-xrg2-pp92: Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerab↗2026-01-13

▶

🕵️Threat Intelligence

Wiz

CVE-2025-11669 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶