CVE-2025-11669: 
Zoho ManageEngine Access Manager Plus vulnerability analysis and mitigation

CVE-2025-11669 is a Missing Authorization (CWE-862) vulnerability affecting the initiate remote session functionality in multiple Zohocorp ManageEngine products. It impacts PAM360 versions before build 8202, Password Manager Pro versions before build 13221, and Access Manager Plus versions prior to build 4401. The vulnerability was disclosed on January 13, 2026, with patches released by ManageEngine in October 2025. It carries a CVSS v3.1 base score of 8.1 (High) (ManageEngine Advisory, Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the affected products fail to properly enforce access control checks when a user initiates a remote session to a managed resource. An authenticated low-privileged user can exploit this flaw over the network without any user interaction to initiate remote sessions to any resource already managed by the product — regardless of whether they have been explicitly granted access to that resource. The attack vector is network-based, requires only low privileges (valid credentials), and has low attack complexity, making it straightforward to exploit once an attacker has authenticated access (ManageEngine Advisory, Feedly).

A successfully exploited vulnerability allows an authenticated low-privileged user to bypass access controls and initiate remote sessions to any resource managed by the affected PAM products — including systems they are not authorized to access. This results in high confidentiality impact (unauthorized access to sensitive systems and data) and high integrity impact (potential for unauthorized modification of managed resources). Availability is not directly impacted, but the ability to access privileged systems managed by a PAM solution could enable significant lateral movement within an organization's infrastructure (ManageEngine Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.009% (0.000090), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or internally accessible ManageEngine PAM360, Password Manager Pro, or Access Manager Plus instances running vulnerable versions (PAM360 ≤ build 8201, Password Manager Pro ≤ build 13220, Access Manager Plus ≤ build 4400).
2. Obtain valid credentials: Acquire low-privileged user credentials for the target ManageEngine product through phishing, credential stuffing, or other means — no elevated privileges are required.
3. Authenticate to the product: Log in to the ManageEngine web interface using the low-privileged account.
4. Abuse the remote session initiation endpoint: Send a crafted request to the remote session initiation functionality, specifying a target resource that the authenticated user is not authorized to access. Due to the missing authorization check, the server does not validate whether the user has permission to initiate a session to that resource.
5. Gain unauthorized remote access: The product establishes a remote session to the targeted managed resource (e.g., a server, network device, or database), granting the attacker access to systems they should not be able to reach (ManageEngine Advisory).

• Logs: Remote session initiation events in PAM360, Password Manager Pro, or Access Manager Plus audit logs where a low-privileged user initiates sessions to resources outside their normal access scope; repeated or anomalous remote session requests from a single user account to multiple resources.
• Behavioral: Low-privileged accounts initiating remote sessions to high-value or sensitive resources (e.g., domain controllers, database servers) that they have no business need to access; unusual volume of remote session initiations from a single account in a short time window.
• Network: Unexpected remote session traffic (RDP, SSH, or other protocols) originating from the ManageEngine server to systems not typically accessed by the connecting user account.

ManageEngine released fixed versions in October 2025: PAM360 build 8202 (released October 13, 2025), Password Manager Pro build 13221 (released October 14, 2025), and Access Manager Plus build 4401 (released October 15, 2025). Organizations should upgrade immediately using the upgrade packs available from the ManageEngine product pages. As additional mitigations, administrators should monitor remote session initiation logs for anomalous activity from low-privileged accounts, implement network segmentation to restrict which systems the ManageEngine server can reach, and enforce multi-factor authentication for product access where possible (ManageEngine Advisory).

The vulnerability received limited but notable coverage in security community channels, including posts on Mastodon (TheHackerWire) and Bluesky shortly after disclosure in January 2026. A weekly threat landscape digest from Hawk-Eye also included the vulnerability in its Week 3 2026 roundup. No major vendor statements beyond ManageEngine's own advisory or significant researcher commentary have been identified (Feedly).