CRITICALCVSS v3.1 9.1Vulnerability
CVE-2026-12507
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-12T07:51:00.177133+00:00
- Cvss severity
- CRITICAL
- Cvss score
- 9.1
- Retrieved at
- 2026-11-12T07:52:20+00:00
- Score
- 9.1
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-12507
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- First seen by Signal
- 2026-11-12T07:52:20+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Published at
- 2026-11-12T07:16:46.750
- Last modified
- 2026-11-12T07:16:46.750
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph