Authenticated Remote Code Execution Vulnerability in ManageEngine Products by Zohocorp
CVE-2026-12507

9.1CRITICAL

Key Information:

Vendor

Zohocorp
Status
Assetexplorer
Servicedesk Plus
Servicedesk Plus Msp
Supportcenter Plus
Vendor
CVE Published:
12 November 2026

What is CVE-2026-12507?

An authenticated remote code execution vulnerability exists in the Reports module of certain ManageEngine products. Specifically, versions of ManageEngine AssetExplorer prior to 7860 and ServiceDesk Plus, including its MSP variant and SupportCenter Plus, that are below versions 15290 and 15150, respectively, are susceptible to exploitation. An attacker with the appropriate permissions can craft malicious database queries, enabling unauthorized execution of commands on the server. This poses significant risks to the integrity and security of affected systems.

Affected Version(s)

AssetExplorer 0 < 7860

ServiceDesk Plus 0 < 15290

ServiceDesk Plus MSP 0 < 15150

References

https://www.manageengine.com/products/service-desk/cve-20...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.