Zohocorp ManageEngine privileged access management products are vulnerable to an authorization bypass in remote session initiation, posing a high risk of unauthorized administrative actions.

This is a missing authorization flaw (CWE-862) occurring within the initiate remote session functionality. The vulnerability requires the attacker to have low-level privileges, as indicated by the CVSS vector (PR:L), to trigger the flaw.

The vulnerability carries a CVSS score of 8.1, reflecting a high severity risk. Successful exploitation could allow an authenticated attacker to bypass authorization controls, potentially gaining unauthorized access to sensitive remote sessions managed by the platform. This leads to significant risks regarding data confidentiality and integrity, as well as potential regulatory non-compliance regarding privileged access management.

Immediate Action: Administrators must update their instances to the specified fixed versions: PAM360 version 8202 or later, Password Manager Pro version 13221 or later, and Access Manager Plus version 4401 or later.

Proactive Monitoring: Security teams should monitor system access logs for anomalous remote session initiation requests, particularly those originating from unexpected user accounts or unusual network segments.

Compensating Controls: Ensure that access to the ManageEngine web interface is restricted to authorized networks via VPN or firewall rules to limit the exposure of the management portal to unauthorized users.

Public Exploit Available: No (exploit_available: false).

Given the critical role of privileged access management software in enterprise security, this vulnerability presents a significant risk to the entire IT infrastructure. Organizations should prioritize the application of the vendor-provided patches immediately to prevent potential privilege escalation or unauthorized remote access. Failure to remediate could allow an attacker to compromise the integrity of the administrative sessions managed by these tools.