---
id: "CVE-2026-12507"
page: "https://infrastack.ai/live/CVE-2026-12507"
kind: "vulnerability"
aliases: ["CVE-2026-12507"]
title: "ManageEngine ServiceDesk Plus: authenticated reports flaw runs commands on server"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["assetexplorer", "manageengine", "self-hosted", "servicedesk-plus", "supportcenter-plus", "vendor"]
not_affected_if: ["fixed-version", "no-query-report-permission"]
published_at: "2026-11-12T07:16:46+00:00"
first_seen_at: "2026-11-12T07:37:03+00:00"
updated_at: "2026-11-12T07:38:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12507", "first_seen_at": "2026-11-12T07:37:03+00:00"}]
exploit_sources: []
---

# ManageEngine ServiceDesk Plus: authenticated reports flaw runs commands on server

Link for people: https://infrastack.ai/live/CVE-2026-12507 (this .md is for agents)

ManageEngine AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus have a flaw in the Reports module. A signed-in user with the Create Query Reports permission can run arbitrary commands on the underlying server through crafted database queries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed build of AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP or SupportCenter Plus against the versions below
- Check which accounts hold the Create Query Reports permission

## Fix

- AssetExplorer: move to `7860` or later
- ServiceDesk Plus: move to `15290` or later
- ServiceDesk Plus MSP: move to `15150` or later
- SupportCenter Plus: move to `15150` or later

## Timeline

- 2026-11-12T07:37:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12507

## From the sources

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_