CVE-2026-12507 PUBLISHED

Authenticated remote code execution

Assigner: Zohocorp
Reserved: 17.06.2026 Published: 12.11.2026 Updated: 12.11.2026

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Zohocorp
Product	AssetExplorer
Versions	Default: unaffected affected from 0 to 7860 (excl.)

Vendor	Zohocorp
Product	ServiceDesk Plus
Versions	Default: unaffected affected from 0 to 15290 (excl.)

Vendor	Zohocorp
Product	ServiceDesk Plus MSP
Versions	Default: unaffected affected from 0 to 15150 (excl.)

Vendor	Zohocorp
Product	SupportCenter Plus
Versions	Default: unaffected affected from 0 to 15150 (excl.)

References

https://www.manageengine.com/products/service-desk/cve-2026-12507.html

Problem Types

CWE-89 – SQL Injection CWE

Impacts

CAPEC-242 – Code Injection