SQL Injection Vulnerability in ManageEngine DataSecurity Plus
CVE-2026-18912

7.7HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Datasecurity Plus
Vendor
CVE Published:
18 September 2026

What is CVE-2026-18912?

ManageEngine DataSecurity Plus is susceptible to an authenticated SQL injection flaw that enables authenticated technicians to run arbitrary SQL queries via the Reports module. This vulnerability can lead to unauthorized data access and manipulation, posing significant risks to data integrity and confidentiality. Organizations utilizing versions before 6310 should prioritize an upgrade to mitigate potential exploits.

Affected Version(s)

ManageEngine DataSecurity Plus 0 < 6310

References

https://www.manageengine.com/data-security/cve-2026-18912...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.