{"id":"CVE-2026-12507","kind":"vulnerability","aliases":["CVE-2026-12507"],"related":[],"title":"ManageEngine ServiceDesk Plus: authenticated reports flaw runs commands on server","description":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.","summary":"ManageEngine AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus have a flaw in the Reports module. A signed-in user with the Create Query Reports permission can run arbitrary commands on the underlying server through crafted database queries.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["assetexplorer","manageengine","self-hosted","servicedesk-plus","supportcenter-plus","vendor"],"not_affected_if":["fixed-version","no-query-report-permission"],"how_to_check":"- Check the installed build of AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus against the versions below\n- Check which accounts hold the Create Query Reports permission","fix":"- AssetExplorer: move to `7860` or later\n- ServiceDesk Plus: move to `15290` or later\n- ServiceDesk Plus MSP: move to `15150` or later\n- SupportCenter Plus: move to `15150` or later","status":"open","published_at":"2026-11-12T07:16:46+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","triaged_at":"2026-11-12T07:38:05+00:00","updated_at":"2026-11-12T07:38:05+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-12T07:38:05Z","model":"claude-haiku-5-5","output":{"fix":"- AssetExplorer: move to `7860` or later\n- ServiceDesk Plus: move to `15290` or later\n- ServiceDesk Plus MSP: move to `15150` or later\n- SupportCenter Plus: move to `15150` or later","reach":"network","title":"ManageEngine ServiceDesk Plus: authenticated reports flaw runs commands on server","impact":"high","summary":"ManageEngine AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus have a flaw in the Reports module. A signed-in user with the Create Query Reports permission can run arbitrary commands on the underlying server through crafted database queries.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","servicedesk-plus","assetexplorer","supportcenter-plus","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs on the server as an authenticated user","analyst_note":"","how_to_check":"- Check the installed build of AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus against the versions below\n- Check which accounts hold the Create Query Reports permission\n- unknown for any further check the sources do not state","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-query-report-permission"],"who_is_affected":"Organizations running AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus below the fixed versions are exposed. Exposure requires an account with the Create Query Reports permission, so tightly held or absent permissions reduce risk. Installations already on the fixed versions are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000797,"input_tokens":4625,"output_tokens":668,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-12507':13A,16A '-2026':12A,15A '15150':85C,91C '15290':79C '7860':74C 'affect':93C 'arbitrari':59B,122C 'assetexplor':17B,30B,71C 'authent':4A,96C,106C 'code':98C 'command':8A,60B,123C 'could':114C 'craft':66B,117C 'creat':53B,110C 'cve':11A,14A 'databas':67B,118C 'execut':99C,121C 'exploit':115C 'flaw':6A,41B 'host':21B 'manageengin':1A,18B,29B,70C 'modul':45B,104C 'msp':35B,82C 'permiss':56B,113C 'plus':3A,24B,27B,32B,34B,38B,76C,81C,88C 'queri':54B,68B,111C,119C 'remot':97C 'report':5A,44B,55B,103C,112C 'run':7A,58B 'self':20B 'self-host':19B 'server':10A,64B,127C 'servicedesk':2A,23B,31B,33B,75C,80C 'servicedesk-plus':22B 'sign':48B 'signed-in':47B 'special':116C 'supportcent':26B,37B,87C 'supportcenter-plus':25B 'under':63B,126C 'user':50B,107C 'vendor':28B 'version':72C,77C,83C,89C 'vulner':100C 'zohocorp':69C","nicknames":[],"mitigations":[],"who_affected":"Organizations running AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus below the fixed versions are exposed. Exposure requires an account with the Create Query Reports permission, so tightly held or absent permissions reduce risk. Installations already on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["assetexplorer","critical","manageengine","selfhosted","servicedeskplus","supportcenterplus","vendor"],"campaign_type":null,"search_a":"'-12507':13A,16A '-2026':12A,15A 'authent':4A 'command':8A 'cve':11A,14A 'flaw':6A 'manageengin':1A 'plus':3A 'report':5A 'run':7A 'server':10A 'servicedesk':2A","search_b":"'arbitrari':59B 'assetexplor':17B,30B 'command':60B 'craft':66B 'creat':53B 'databas':67B 'flaw':41B 'host':21B 'manageengin':18B,29B 'modul':45B 'msp':35B 'permiss':56B 'plus':24B,27B,32B,34B,38B 'queri':54B,68B 'report':44B,55B 'run':58B 'self':20B 'self-host':19B 'server':64B 'servicedesk':23B,31B,33B 'servicedesk-plus':22B 'sign':48B 'signed-in':47B 'supportcent':26B,37B 'supportcenter-plus':25B 'under':63B 'user':50B 'vendor':28B","search_c":"'15150':85C,91C '15290':79C '7860':74C 'affect':93C 'arbitrari':122C 'assetexplor':71C 'authent':96C,106C 'code':98C 'command':123C 'could':114C 'craft':117C 'creat':110C 'databas':118C 'execut':99C,121C 'exploit':115C 'manageengin':70C 'modul':104C 'msp':82C 'permiss':113C 'plus':76C,81C,88C 'queri':111C,119C 'remot':97C 'report':103C,112C 'server':127C 'servicedesk':75C,80C 'special':116C 'supportcent':87C 'under':126C 'user':107C 'version':72C,77C,83C,89C 'vulner':100C 'zohocorp':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12507","severity":null,"published_at":"2026-11-12T07:16:46+00:00","modified_at":"2026-11-12T07:16:46+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","fetched_at":"2026-11-12T07:37:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}