CVE-2026-125079.1Critical
CVE-2026-12507: Authenticated remote code execution
Zohocorp · AssetExplorer
Vendor fix available · Affected: Zohocorp AssetExplorer · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
9.4%probability of exploitation in the next 30 days
95th percentile
050100
Higher than 95% of scored CVEs
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- Zoho fixes eight ManageEngine flaws, including CVE-2026-12591SecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.