Critical Zoho Analytics Plus Flaw (CVE-2025-8324, CVSS 9.8) Allows Unauthenticated SQL Injection and Data Takeover

Zoho Analytics Plus has a critical on‑premise flaw tracked as CVE-2025-8324 with a CVSS of 9.8 that allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially exposing data and, in severe cases, taking over user accounts. According to the security advisory, the vulnerability stems from insecure handling of user‑supplied parameters in specific Analytics Plus backend URLs, and it affects all Analytics Plus on‑premise builds below 6170, with a fix released in Build 6171.

The advisory warns that exploitation can lead to unauthorized exposure of user information and possible account takeovers, underscoring the high risk for exposed or poorly segmented deployments. Zoho instructs all on‑premise customers to update immediately, providing steps that include downloading the latest upgrade pack from the official service pack page and following the accompanying upgrade instructions.

Analytics Plus is widely used for enterprise analytics and data processing, which amplifies the potential impact of this unauthenticated SQL injection vulnerability.