High-severity SQL injection vulnerability in Zoho ADAudit Plus

## Overview Zoho Corporation disclosed a high-severity vulnerability in ManageEngine ADAudit Plus. The flaw is identified as CVE-2026-12062. It affects versions of ADAudit Plus prior to 8703. This vulnerability allows for authenticated SQL injection through the Reports API. ## Technical Details The vulnerability occurs in the Reports API of ADAudit Plus. An attacker with valid credentials can exploit this weakness to execute arbitrary SQL queries. This could lead to unauthorized data access or manipulation within the database. The CVSS score for this vulnerability is 8.8, indicating a high level of severity. ## Impact Successful exploitation of CVE-2026-12062 can result in significant data breaches. Attackers could gain access to sensitive information stored in the ADAudit Plus database. This could compromise the integrity and confidentiality of user data, leading to potential compliance issues and reputational damage for affected organizations. ## Mitigation Defenders should immediately update their ADAudit Plus installations to version 8703 or later. Regularly reviewing and applying security patches is essential to protect against such vulnerabilities. Additionally, organizations should implement strong access controls and monitor database activity for any suspicious behavior.