CVE-2026-18199: OS Command Injection

Published Nov 2, 2026

Updated

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zohocorp ManageEngine Password Manager Pro to a version that resolves this vulnerability.
Fixed in 13236
Upgrade
Upgrade Zohocorp ManageEngine PAM360 to a version that resolves this vulnerability.
Fixed in 8601

Event History

Nov 2, 2026

CVE Published

via NVD·08:17 AM

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are affected.

What access does an attacker need to exploit this issue?

The vulnerability is authenticated, so an attacker needs valid credentials or an existing authenticated session. No user interaction is required, and it can be exploited remotely over the network.

What could a successful exploit allow?

Successful exploitation can result in remote code execution through OS command injection, with high impact to confidentiality, integrity, and availability.

CVE-2026-18199: OS Command Injection

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could a successful exploit allow?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could a successful exploit allow?