CVE-2026-12062 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine ADAudit Plus versions below 8703 contain an SQL injection flaw in the Reports API. An attacker with a valid login can alter database queries to read or change the audit database.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any organization running ADAudit Plus below build 8703 where at least one user has an account that can reach the Reports API. The sources do not describe a configuration that changes exposure. Instances already on 8703 or later are not affected.
Not affected if no-authenticated-users-exposed, version-8703-or-later
Who cares active-directory, adaudit-plus, manageengine, windows
8703 in the product's About page or install directory8703 or laterZoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.