by Kastro
Paper/Archive/CVE-2026-12507

CVE-2026-12507

Zohocorp AssetExplorer — Authenticated remote code execution

EPSS 9%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 95.5.955 × 2019.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

Affected

ProductAffectedFixed inSource
AssetExplorer< 78607860CNA
ServiceDesk Plus< 1529015290CNA
ServiceDesk Plus MSP< 1515015150CNA
SupportCenter Plus< 1515015150CNA

Scores by source

Zohocorp (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refmanageengine.com/products/service-desk/cve-2026-12507.html