ManageEngine security advisory—Important security fixes released for ManageEngine PAM360
Hi there,
This security advisory is to let you know that a security vulnerability of high severity was detected in ManageEngine PAM360.
Severity: High.
What is the issue?
An SQL Injection vulnerability was identified in PAM360, along with a separate Remote Code Execution vulnerability via a third-party library. Both vulnerabilities have been addressed, and neither issue exists in the fixed version.
Version details
Product Name | Issue | Affected Version(s) | Fixed Version(s) | Fixed On |
PAM360 | SQL injection | Till 8530 | 8531 | April 2, 2026 |
PAM360 | Remote Code Execution | Till 8531 | 8532 | April 7, 2026 |
PAM360 Application Gateway | Remote Code Execution | Till 5500 | 5501 | April 7, 2026 |
(Please note that this vulnerability applies to only those who have installed or upgraded to the above mentioned versions).
Impact:
The SQL injection vulnerability allows an adversary with a Password Auditor role to execute custom queries, and escalate to Privileged Administrator and perform sensitive actions. For more details on the vulnerability, please click here.
Additionally, the third-party library's API was found to be vulnerable to Remote Code Execution.
What should customers do?
Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of PAM360 immediately.
Steps to Upgrade:
Download the latest upgrade packs from the following link.
PAM360 - https://www.manageengine.com/privileged-access-management/upgradepack.html
PAM360 Application Gateway: https://www.manageengine.com/privileged-access-management/application-gateway/upgradepack.html
Apply the latest upgrade pack to your existing product installation as per the upgrade pack instructions provided in the above links.
Please contact our product support team for further details at the below mentioned email addresses:
PAM360: pam360-support@manageengine.com
Important note: We strongly recommend that you take a backup of your entire PAM360 installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the PAM360 database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.
Thanks,
Dhamodhara Reddy
Head -Enterprise Support
Toll-Free: +1 888 720 9500