PT-2026-21502 · Manageengine · Zoho Manageengine Adselfservice Plus

Nguyen Dang Toan · Published 2026-02-23 · Updated 2026-02-28 · CVE-2026-1367

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions 6522 and below

Description ManageEngine ADSelfService Plus versions 6522 and below are susceptible to an authenticated SQL Injection issue in the search report option. An attacker with valid credentials can inject malicious SQL code into the search input, potentially compromising the underlying database. The vulnerability exists within the search report feature.

Recommendations Versions prior to 6523 are affected.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-1367

Affected Products

Zoho Manageengine Adselfservice Plus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1367 · Security Note
• https://twitter.com/cracbot/status/2027700361277145455 · Twitter Post
• https://twitter.com/CveTodo/status/2025850167996334424 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025854270356988210 · Twitter Post
• https://twitter.com/CVEnew/status/2025892031063544289 · Twitter Post
• https://twitter.com/TheHackerWire/status/2025848317255770469 · Twitter Post
• https://t.me/CVEtracker/45481 · Telegram Post
• https://manageengine.com/uk/products/self-service-password/advisory/CVE-2026-1367.html · Note
• https://twitter.com/cracbot/status/2027338060833448196 · Twitter Post