This vulnerability (CVE-2026-5785) is an authenticated SQL injection (CWE-89) in the query report module of Zohocorp ManageEngine PAM360 and Password Manager Pro. It affects PAM360 versions prior to 8531 and Password Manager Pro versions 8600 through 13230. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality and integrity. The vulnerability allows an attacker with valid credentials to inject malicious SQL commands, potentially compromising sensitive data. No patch or official remediation level has been published yet.

Successful exploitation can lead to unauthorized disclosure and modification of sensitive data within the affected ManageEngine products. The vulnerability requires authenticated access but has a low attack complexity and no user interaction, increasing the risk for privileged users to abuse it. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the query report module to trusted users only and monitor for unusual activity. Avoid exposing the affected versions to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.