{"id":"CVE-2026-76981","kind":"vulnerability","aliases":["CVE-2026-76981"],"related":[],"title":"ManageEngine ADAudit Plus: authenticated SQL injection in custom reports module","description":"Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.","summary":"ManageEngine ADAudit Plus versions below 8711 contain a second-order SQL injection in the custom reports module. A logged-in user can plant a payload that the product later runs as database queries.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","adaudit-plus","manageengine","vendor","windows"],"not_affected_if":["build-8711-or-later"],"how_to_check":"- Check the installed ADAudit Plus build number against `8711` in the product's About page or install directory","fix":"- ADAudit Plus: move to `8711` or later (per the NVD description)","status":"open","published_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:46+00:00","updated_at":"2026-11-11T08:27:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T08:27:46Z","model":"claude-haiku-5-5","output":{"fix":"- ADAudit Plus: move to `8711` or later (per the NVD description)","reach":"network","title":"ManageEngine ADAudit Plus: authenticated SQL injection in custom reports module","impact":"high","summary":"ManageEngine ADAudit Plus versions below 8711 contain a second-order SQL injection in the custom reports module. A logged-in user can plant a payload that the product later runs as database queries.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","adaudit-plus","windows","active-directory"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"database contents read or altered through injected SQL","analyst_note":"Check the Zoho advisory for the exact affected build range, required privilege, and any workaround; NVD text alone is thin.","how_to_check":"- Check the installed ADAudit Plus build number against `8711` in the product's About page or install directory\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["build-8711-or-later"],"who_is_affected":"Organizations running ADAudit Plus below build 8711 where users hold accounts that can reach the custom reports module. The sources do not say which report configurations are required to trigger it, so unknown. Instances already on 8711 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4532,"output_tokens":497,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-76981':13A,16A '8711':31B,68C 'activ':18B 'active-directori':17B 'adaudit':2A,21B,27B,64C,80C 'adaudit-plus':20B 'affect':79C 'authent':4A,73C 'contain':32B 'corpor':62C 'custom':8A,41B,82C 'cve':11A,14A 'databas':59B 'directori':19B 'inject':6A,38B,77C 'later':56B 'log':46B 'logged-in':45B 'manageengin':1A,23B,26B,63C 'modul':10A,43B,84C 'order':36B,75C 'payload':52B 'plant':50B 'plus':3A,22B,28B,65C,81C 'product':55B 'queri':60B 'report':9A,42B,83C 'run':57B 'second':35B,74C 'second-ord':34B 'sql':5A,37B,76C 'user':48B 'vendor':24B 'version':29B,66C 'vulner':70C,78C 'window':25B 'zoho':61C","nicknames":[],"mitigations":[],"who_affected":"Organizations running ADAudit Plus below build 8711 where users hold accounts that can reach the custom reports module. The sources do not say which report configurations are required to trigger it, so unknown. Instances already on 8711 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","adauditplus","high","manageengine","vendor","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-76981':13A,16A 'adaudit':2A 'authent':4A 'custom':8A 'cve':11A,14A 'inject':6A 'manageengin':1A 'modul':10A 'plus':3A 'report':9A 'sql':5A","search_b":"'8711':31B 'activ':18B 'active-directori':17B 'adaudit':21B,27B 'adaudit-plus':20B 'contain':32B 'custom':41B 'databas':59B 'directori':19B 'inject':38B 'later':56B 'log':46B 'logged-in':45B 'manageengin':23B,26B 'modul':43B 'order':36B 'payload':52B 'plant':50B 'plus':22B,28B 'product':55B 'queri':60B 'report':42B 'run':57B 'second':35B 'second-ord':34B 'sql':37B 'user':48B 'vendor':24B 'version':29B 'window':25B","search_c":"'8711':68C 'adaudit':64C,80C 'affect':79C 'authent':73C 'corpor':62C 'custom':82C 'inject':77C 'manageengin':63C 'modul':84C 'order':75C 'plus':65C,81C 'report':83C 'second':74C 'sql':76C 'version':66C 'vulner':70C,78C 'zoho':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76981","severity":null,"published_at":"2026-11-11T08:17:18+00:00","modified_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}