Affected product(s):
| Product | Affected versions | Fixed version |
| ManageEngine Password Manager Pro | Build 13235 and earlier | 13236 |
| ManageEngine PAM360 | Build 8600 and earlier | 8601 |
| ManageEngine SharePoint Manager Plus | Builds earlier than 4508 | 4508 |
In SharePoint Manager Plus, CVE-2026-119682 was fixed in build 4507 and CVE-2026-119680 in build 4508.
Description
Three high-severity vulnerabilities have been published in ManageEngine products. The main one, labeled CVE-2026-18199 (CVSSv3.1 8.8 – HIGH), affects Password Manager Pro and PAM360 and allows an authenticated remote attacker to execute arbitrary operating system commands on the server. It is of the operating system command injection type (CWE-78). The other two, CVE-2026-119680 and CVE-2026-119682, affect SharePoint Manager Plus.
Password Manager Pro and PAM360 are password and privileged access management solutions that store credentials, SSH keys and certificates, so a compromise of the server can open the door to the rest of the infrastructure.
The vulnerabilities are detailed below:
| Identifier | Product | Score | Description |
| CVE-2026-18199 | Password Manager Pro and PAM360 | CVSS 3.1: 8.8 | Operating system command injection (CWE-78). According to the published information, a low-privilege account is sufficient and no user interaction is required. The vendor fixed it by adding server-side validation and escaping of special characters, without detailing the affected module or parameter. |
| CVE-2026-119680 | SharePoint Manager Plus | CVSS 4.0: 8.5 | Stored XSS (CWE-79). A user with low privileges can inject HTML or JavaScript into attributes used to generate charts (full user names, site names or group names). The code executes in the browser of other users, including administrators, when those charts are displayed. |
| CVE-2026-119682 | SharePoint Manager Plus | CVSS 4.0: 7.9 | Missing authorization (CWE-862). An authenticated user with low privileges can bypass the authorization controls of multi-factor authentication (MFA): read and modify its configuration, enable or disable it, enumerate enrolled users and delete enrolled accounts. This weakens authentication or may leave legitimate users without access. |
The CVSS vector for CVE-2026-18199 is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and its CVE record was published on 02/11/2026.
As of 03/11/2026 there are no reports of active exploitation or public proofs of concept, and none of the three vulnerabilities is listed in the Known Exploited Vulnerabilities (KEV) catalog of the U.S. cybersecurity agency. Its EPSS is 2.45% for CVE-2026-18199 (84th percentile), 0.34% for CVE-2026-119682 and 0.24% for CVE-2026-119680. Researchers point out that ManageEngine products, including PAM360 and Password Manager Pro, have already been targeted by mass exploitation in the past (for example, CVE-2022-47966 and CVE-2022-35405), so the update should not be delayed.
Mitigation
Until the update is applied, it is recommended to:
- Restrict access to the Password Manager Pro, PAM360 and SharePoint Manager Plus web console to administrative networks or VPN, without exposing it to the Internet.
- Review accounts with console access, remove those that are not used and apply the principle of least privilege, since all three flaws require an authenticated account.
- Review audit logs for unusual command execution, unexpected child processes of the PAM360 or Password Manager Pro service, and unauthorized changes to the MFA configuration.
- If a compromise of the PAM server is suspected, rotate the privileged credentials it manages.
Solution
The solution is to update to the following versions or later:
- Password Manager Pro: build 13236.
- PAM360: build 8601.
- SharePoint Manager Plus: build 4508, which fixes both vulnerabilities in the product.
The update packages for each product are listed in the Additional information section.
For information on how to update, visit the following link:
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-18199.html
Additional information:
- ManageEngine — CVE-2026-18199 security advisory:
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-18199.html - ManageEngine PAM360 — fixed issues:
https://www.manageengine.com/privileged-access-management/issues-fixed.html - ManageEngine PAM360 — upgrade package:
https://www.manageengine.com/privileged-access-management/upgradepack.html - ManageEngine Password Manager Pro — upgrade package:
https://www.manageengine.com/products/passwordmanagerpro/upgradepack.html - ManageEngine SharePoint Manager Plus — build 4508:
https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here - ManageEngine SharePoint Manager Plus — build 4507:
https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4507-released - CVE.org — CVE-2026-18199:
https://www.cve.org/CVERecord?id=CVE-2026-18199 - CVE.org — CVE-2026-119680:
https://www.cve.org/CVERecord?id=CVE-2026-119680 - CVE.org — CVE-2026-119682:
https://www.cve.org/CVERecord?id=CVE-2026-119682 - CERT-PY — vulnerabilities in ManageEngine products:
https://www.cert.gov.py/vulnerabilidades-en-productos-manageengine-3/ - cyberveille.esante.gouv.fr — alert on CVE-2026-18199:
https://cyberveille.esante.gouv.fr/alertes/zohocorp-cve-2026-18199-2026-11-03