Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ServiceDesk Plus by Zohocorp
CVE-2026-12507 (GCVE-0-2026-12507)
Vulnerability from nvd – Published: 2026-11-12 06:48 – Updated: 2026-11-14 04:56
VLAI
EPSS
VEX
Title
Authenticated remote code execution
Summary
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-89 - – SQL Injection
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | AssetExplorer |
Affected:
0 , < 7860
(custom)
cpe:2.3:a:zohocorp:assetexplorer:*:*:*:*:*:*:*:* |
|
| Zohocorp | ServiceDesk Plus |
Affected:
0 , < 15290
(custom)
cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:* |
|
| Zohocorp | ServiceDesk Plus MSP |
Affected:
0 , < 15150
(custom)
cpe:2.3:a:zohocorp:servicedesk_plus_msp:*:*:*:*:*:*:*:* |
|
| Zohocorp | SupportCenter Plus |
Affected:
0 , < 15150
(custom)
cpe:2.3:a:zohocorp:supportcenter_plus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:56:54.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AssetExplorer",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "7860",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ServiceDesk Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15290",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ServiceDesk Plus MSP",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SupportCenter Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:assetexplorer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7860",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15290",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus_msp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15150",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:supportcenter_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15150",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eZohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the \u003c/span\u003e\u003cspan\u003e\u003cspan\u003eCreate Query Reports\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.\u003c/span\u003e"
}
],
"value": "Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 \u2013 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 \u2013 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T06:48:54.703Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/products/service-desk/cve-2026-12507.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated remote code execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-12507",
"datePublished": "2026-11-12T06:48:54.703Z",
"dateReserved": "2026-06-17T10:49:52.198Z",
"dateUpdated": "2026-11-14T04:56:54.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12507 (GCVE-0-2026-12507)
Vulnerability from cvelistv5 – Published: 2026-11-12 06:48 – Updated: 2026-11-14 04:56
VLAI
EPSS
VEX
Title
Authenticated remote code execution
Summary
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-89 - – SQL Injection
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | AssetExplorer |
Affected:
0 , < 7860
(custom)
cpe:2.3:a:zohocorp:assetexplorer:*:*:*:*:*:*:*:* |
|
| Zohocorp | ServiceDesk Plus |
Affected:
0 , < 15290
(custom)
cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:* |
|
| Zohocorp | ServiceDesk Plus MSP |
Affected:
0 , < 15150
(custom)
cpe:2.3:a:zohocorp:servicedesk_plus_msp:*:*:*:*:*:*:*:* |
|
| Zohocorp | SupportCenter Plus |
Affected:
0 , < 15150
(custom)
cpe:2.3:a:zohocorp:supportcenter_plus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:56:54.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AssetExplorer",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "7860",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ServiceDesk Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15290",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ServiceDesk Plus MSP",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SupportCenter Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "15150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:assetexplorer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7860",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15290",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus_msp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15150",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:supportcenter_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15150",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eZohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the \u003c/span\u003e\u003cspan\u003e\u003cspan\u003eCreate Query Reports\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.\u003c/span\u003e"
}
],
"value": "Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 \u2013 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 \u2013 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T06:48:54.703Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/products/service-desk/cve-2026-12507.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated remote code execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-12507",
"datePublished": "2026-11-12T06:48:54.703Z",
"dateReserved": "2026-06-17T10:49:52.198Z",
"dateUpdated": "2026-11-14T04:56:54.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}