Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and…
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Zohocorp
- Product
- AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP
- CVSS v3.1
- 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Weakness
- CWE-89
- Exposure class
- Identity
- NVD status
- Received
Why it ranks 45 (High)
- CVSS v3.1 9.1 critical
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-12507 on this site · NVD · CVE.org · Vulnpedia