This vulnerability (CVE-2026-5785) is an authenticated SQL injection (CWE-89) in the query report module of Zohocorp ManageEngine PAM360 and Password Manager Pro. It affects PAM360 versions prior to 8531 and Password Manager Pro versions 8600 through 13230. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. The vulnerability allows an authenticated attacker to inject malicious SQL commands, potentially leading to unauthorized data access or modification. No patch or official remediation level has been disclosed by the vendor as of the publication date.

An attacker with valid credentials can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure and modification of sensitive data within the affected ManageEngine products. The vulnerability does not impact availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected modules to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected services to untrusted networks.