CVE-2026-12507 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus have a flaw in the Reports module. A signed-in user with the Create Query Reports permission can run arbitrary commands on the underlying server through crafted database queries.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus below the fixed versions are exposed. Exposure requires an account with the Create Query Reports permission, so tightly held or absent permissions reduce risk. Installations already on the fixed versions are not affected.
Not affected if fixed-version, no-query-report-permission
Who cares assetexplorer, manageengine, self-hosted, servicedesk-plus, supportcenter-plus
7860 or later15290 or later15150 or later15150 or laterZohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.