Authenticated RCE in ManageEngine AssetExplorer/ServiceDesk Plus Reports
CVE-2026-12507 Published on November 12, 2026

Authenticated remote code execution
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

NVD

Vulnerability Analysis

CVE-2026-12507 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a SQL Injection Vulnerability?

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE-2026-12507 has been classified to as a SQL Injection vulnerability or weakness.

Products Associated with CVE-2026-12507

Want to know whenever a new CVE is published for Zoho Corp products? stack.watch will email you.

Zoho Corp Assetexplorer

  Watch

Zoho Corp Servicedesk Plus

  Watch

Zoho Corp Servicedesk Plus Msp

  Watch

Zoho Corp Supportcenter Plus

  Watch

Affected Versions

• Before 7860 is affected.

• Before 15290 is affected.

• Before 15150 is affected.

• Before 15150 is affected.

Exploit Probability