Hi there,

This security advisory is to let you know that a security vulnerability of high severity was detected in ManageEngine Password Manager Pro.

CVE ID: CVE-2025-11669

Severity: High.

What is the issue?

An unauthorized access vulnerability was discovered in Password Manager Pro. We have fixed this issue, and the vulnerability no longer exists in the fixed version.

Version details

Impact:

An unauthorized access vulnerability in Password Manager Pro allows authenticated users to initiate remote sessions to any resource (already managed by the product).

Note: This vulnerability is exploitable only if these resources are accessible from the respective server where Password Manager Pro is installed.

What should customers do?

Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of Password Manager Pro immediately.

Steps to Upgrade:

1. Download the latest upgrade pack from the following link:

Password Manager Pro - https://www.manageengine.com/products/passwordmanagerpro/minor-upgrades.html

2. Apply the latest upgrade pack to your existing product installation as per the upgrade pack instructions provided in the above link.

Please contact our product support team for further details at the below mentioned email addresses:

Password Manager Pro: passwordmanagerpro-support@manageengine.com 

Important note: We strongly recommend that you take a backup of your entire Password Manager Pro installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the Password Manager Pro database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

Please ignore this message if you have already upgraded to the latest build of Password Manager Pro. We express our sincerest apologies for any inconvenience this may have caused.

Regards,