CVE-2026-12062: Authenticated SQL Injection

Q: Which deployments are affected?

Zoho ManageEngine ADAudit Plus versions below 8703 are affected. The vulnerable component is the ADAudit Plus Reports API.

Q: What access does an attacker need to exploit this issue?

An attacker needs authenticated access with low privileges. The CVSS vector indicates exploitation can be performed remotely with low attack complexity and no user interaction.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in high impact to confidentiality, integrity, and availability, according to the CVSS metrics.

Q: What version should be used to remediate the vulnerability?

Upgrade ADAudit Plus to version 8703 or later. Versions below 8703 are identified as vulnerable.

Published Nov 11, 2026

Updated

Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.

Affected Software

1 affected component

Zoho ManageEngine ADAudit Plus<8703

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zoho ManageEngine ADAudit Plus to a version that resolves this vulnerability.
Fixed in 8703

Event History

Nov 11, 2026

CVE Published

via MITRE·07:38 AM

Data Sourced

via MITRE·07:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Zoho ManageEngine ADAudit Plus versions below 8703 are affected. The vulnerable component is the ADAudit Plus Reports API.

What access does an attacker need to exploit this issue?

An attacker needs authenticated access with low privileges. The CVSS vector indicates exploitation can be performed remotely with low attack complexity and no user interaction.

What is the potential impact of successful exploitation?

Successful exploitation can result in high impact to confidentiality, integrity, and availability, according to the CVSS metrics.

What version should be used to remediate the vulnerability?

Upgrade ADAudit Plus to version 8703 or later. Versions below 8703 are identified as vulnerable.

CVE-2026-12062: Authenticated SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

What version should be used to remediate the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

What version should be used to remediate the vulnerability?