Hi there,

This security advisory is to let you know that a security vulnerability of high severity was detected in ManageEngine Access Manager Plus.

Severity: High.

What is the issue?

A Remote Code Execution vulnerability in a third-party library was identified in Access Manager Plus. The issue has been fixed and the vulnerability no longer exists in the fixed version.

Version details

(Please note that this vulnerability applies to only those who have installed or upgraded to the above mentioned version)

Impact:

The third-party library's API was found to be vulnerable to Remote Code Execution.

What should customers do?

Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of Access Manager Plus immediately.

Steps to Upgrade:

1. Download the latest upgrade pack from the following link.

Access Manager Plus - https://www.manageengine.com/privileged-session-management/upgradepack.html

2. Apply the latest upgrade pack to your existing product installation as per the upgrade pack instructions provided in the above link.

Please contact our product support team for further details at the below mentioned email address:

Access Manager Plus: accessmanagerplus-support@manageengine.com

Important note: We strongly recommend you take a backup of your entire Access Manager Plus installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the Access Manager Plus database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

Thanks,

Dhamodhara Reddy

Head -Enterprise Support

Toll-Free: +1 888 720 9500

Email: pam360-support@manageengine.com