ManageEngine ADAudit Plus: Authenticated SQL injection in Reports API
Summary
ManageEngine ADAudit Plus, a Windows Active Directory auditing and reporting product, contains an SQL injection flaw in its Reports API. An attacker with a valid ADAudit Plus login can send a crafted request to execute arbitrary SQL queries and read database records. Exploitation requires low privileges and no user interaction, and the vendor reports the issue as fixed in build 8703.
Affected
- ManageEngine ADAudit Plus builds below 8703
- Vulnerability type: CWE-89 (SQL injection) in the Reports API
- CVSS v3.1: 8.8 (High)
Fixed in
- Build 8703 (vendor release, June 12, 2026)
- Newer builds are available; the vendor release notes also list Build 8712 (September 02, 2026). Install the latest build.
Workaround
Unknown.
- Until patched, restrict access to the ADAudit Plus web console to administrative networks (analyst recommendation, not vendor-sourced).
Exploitation
- Known exploitation in the wild: no evidence found.
- CISA KEV: not listed according to OpenCVE; the KEV catalogue was not checked directly.
- Public proof of concept: none found as of 10 November 2026.
Our recommendation
- Inventory all ADAudit Plus instances and their build numbers.
- Upgrade to the latest available build, at least 8712.
- Restrict console and API access to administrative networks and review user accounts with ADAudit Plus logins.
- Monitor report-related audit logs for unusual query activity.
- Check the vendor advisory directly, as its content could not be verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ManageEngine CVE-2026-12062 advisory www.manageengine.com
- ADAudit Plus release notes www.manageengine.com
- OpenCVE CVE-2026-12062 app.opencve.io
- OffSeq Radar CVE-2026-12062 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:21.
Original description (NVD)
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.