Authenticated SQL Injection Vulnerability in ManageEngine ADAudit Plus by Zohocorp

CVE-2025-27709

What is CVE-2025-27709?

The ManageEngine ADAudit Plus software by Zohocorp, specifically versions 8510 and earlier, is susceptible to an authenticated SQL injection vulnerability. This security flaw could allow an attacker with valid credentials to manipulate SQL queries in the Service Account Auditing reports, potentially leading to unauthorized data disclosure or alterations. It is crucial for organizations utilizing this product to apply necessary security patches to protect sensitive data and maintain robust security practices.

References