PT-2025-24423 · Zoho · Zoho Manageengine Adaudit Plus

Published 2025-05-09 · Updated 2025-06-16 · CVE-2025-36528

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine ADAudit Plus versions 8510 and prior

Description The issue concerns an authenticated SQL injection vulnerability in the Service Account Auditing reports of the affected software.

Recommendations For Zohocorp ManageEngine ADAudit Plus versions 8510 and prior, update to a version later than 8510 to resolve the issue. As a temporary workaround, consider restricting access to the Service Account Auditing reports until a patch is available.

Fix

SQL injection

Unrestricted File Upload

Weakness Enumeration

CWE-89

CWE-434

Related Identifiers

BDU:2025-06655

BDU:2025-06704

CVE-2025-36528

Affected Products

Zoho Manageengine Adaudit Plus

References · 11

• https://osv.dev/vulnerability/CVE-2025-36528 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06655 · Security Note
• https://manageengine.com/products/active-directory-audit/cve-2025-36528.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06704 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-36528 · Security Note
• https://twitter.com/threatsbank/status/1932067658696151494 · Twitter Post
• https://twitter.com/CVEnew/status/1932037605496947088 · Twitter Post
• https://t.me/cvetracker/25767 · Telegram Post
• https://t.me/latest_high_impact_cve/2590 · Telegram Post
• https://twitter.com/dailycve/status/1934689534114972012 · Twitter Post
• https://t.me/cvenotify/125059 · Telegram Post