CVE-2026-14828: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in Zohocorp ManageEngine Password Manager Pro

CVE-2026-14828 is an authenticated SQL Injection vulnerability (CWE-89) affecting Zohocorp ManageEngine Password Manager Pro versions prior to 13235, PAM360 versions prior to 8561, and Access Manager Plus versions prior to 4405. The flaw allows an attacker with legitimate access privileges to inject malicious SQL commands, potentially compromising the database and leading to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8, indicating a high severity level. The vendor has not published an official fix or remediation details as of the publication date.

Successful exploitation of this vulnerability can lead to unauthorized disclosure, modification, or deletion of sensitive data stored in the affected products' databases. It may also allow attackers to escalate privileges or disrupt service availability. The impact is rated high due to the potential for complete compromise of the affected system's data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict access to the affected applications to trusted users only and monitor for unusual activity. No vendor-provided mitigation or workaround is currently documented.