Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-12507 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Zohocorp |
| Product | ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, AssetExplorer, SupportCenter Plus |
| Vulnerability Type | SQL injection leading to RCE (CWE-89) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by an authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
According to the vendor advisory, the crafted queries use Jasper expressions. The fix restricts input validation to the required privileges and blocks queries that trigger Jasper expressions. The vendor rates the issue as “High”; NVD scores it 9.1 on the CVSS scale.
Required Actions
- Install the latest service pack: ServiceDesk Plus 15290, ServiceDesk Plus MSP 15150, AssetExplorer 7860 or SupportCenter Plus 15150 (or later).
- Until then, restrict the Create Query Reports permission to the accounts that actually need it.
- Review the accounts holding this permission and recently created query reports for unexpected SQL queries.
Who Is Affected?
The vulnerability affects Zohocorp ManageEngine products: ServiceDesk Plus 15280 and earlier, ServiceDesk Plus MSP 15140 and earlier, SupportCenter Plus 15140 and earlier, and AssetExplorer 7850 and earlier. These are helpdesk, ITSM and IT asset management systems used by enterprises and public institutions for ticket handling and hardware inventory.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-12507 vulnerability?
CVE-2026-12507 is a flaw in the Reports module of ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, AssetExplorer and SupportCenter Plus (CWE-89) that allows an authenticated user with the Create Query Reports permission to execute arbitrary commands on the server. CVSS score: 9.1.
Does exploiting CVE-2026-12507 require authentication?
Yes. The attacker needs an account with the Create Query Reports permission in the Reports module; no interaction from another user is required.
How to protect against CVE-2026-12507?
Install the vendor service pack: ServiceDesk Plus 15290, ServiceDesk Plus MSP 15150, AssetExplorer 7860 or SupportCenter Plus 15150 (or later), and until then restrict the Create Query Reports permission to the accounts that need it.
Who is affected by CVE-2026-12507?
Organizations running ServiceDesk Plus 15280 and earlier, ServiceDesk Plus MSP and SupportCenter Plus 15140 and earlier, and AssetExplorer 7850 and earlier.
