The security advisory addresses an unauthenticated remote code execution vulnerability identified in ManageEngine PAM360.
Given the severity of this vulnerability, we strongly urge all customers to install the latest build of the PAM360.
The complete fix for this is now available in the below version,
5500 and below
This remote code execution vulnerability could allow remote attackers to execute arbitrary code on affected installations of PAM360. Authentication is not required to exploit this vulnerability.
We have fixed this vulnerability by removing the vulnerable components from PAM360.
What should customers do?
The latest version of PAM360 holds the recommended mitigation targeting the vulnerability.
Steps to Upgrade:
Important note: We strongly recommend that you take a backup of your entire PAM360 installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, back up the PAM360 database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.
We express our sincerest apologies for any inconvenience this may have caused.