CVE-2026-12507: Authenticated remote code execution
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zohocorp ManageEngine AssetExplorerto a version that resolves this vulnerability.Fixed in 7860 - Upgrade
Upgrade
ManageEngine ServiceDesk Plusto a version that resolves this vulnerability.Fixed in 15290 - Upgrade
Upgrade
ManageEngine ServiceDesk Plus MSPto a version that resolves this vulnerability.Fixed in 15150 - Upgrade
Upgrade
ManageEngine SupportCenter Plusto a version that resolves this vulnerability.Fixed in 15150
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the Create Query Reports permission in the Reports module. The issue can be exploited remotely without user interaction once those requirements are met.
Which deployments are affected?
Affected versions are AssetExplorer below 7860, ServiceDesk Plus below 15290, ServiceDesk Plus MSP below 15150, and SupportCenter Plus below 15150. Deployments at or above those version thresholds are not identified as affected by the provided information.
What is the potential impact of successful exploitation?
A permitted authenticated user can use specially crafted database queries to execute arbitrary commands on the underlying server. This can affect confidentiality, integrity, and availability beyond the privileges of the reporting user.