CVE-2025-11669

Published: Jan 13, 2026Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 0fc0942c-577d-436f-ae8e-945763c79b02 (Secondary)

Description

Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

Affected (9)

Products: Zohocorp: Manageengine Pam360, Manageengine Access Manager Plus, Manageengine Password Manager Pro

Zohocorp

3 products

Manageengine Pam360

Manageengine Access Manager Plus

Manageengine Password Manager Pro

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Pam360	Before 8.2
Zohocorp Manageengine Pam360	Version 8.2 build8200
Zohocorp Manageengine Pam360	Version 8.2 build8201

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Access Manager Plus	Before 4.4
Zohocorp Manageengine Access Manager Plus	Version 4.4 build4400

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Password Manager Pro	Before 13.2
Zohocorp Manageengine Password Manager Pro	Version 13.2 build13200
Zohocorp Manageengine Password Manager Pro	Version 13.2 build13210
Zohocorp Manageengine Password Manager Pro	Version 13.2 build13220

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://www.manageengine.com/privileged-access-management/advisory/cve-2025-11669.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

PatchVendor Advisory

Timeline

No history available yet.