High-Severity SQL Injection Vulnerability in Zoho ADAudit Plus

## Overview Zoho Corporation disclosed a high-severity vulnerability in ManageEngine ADAudit Plus. The flaw, identified as CVE-2026-76981, affects versions prior to 8711. It involves an authenticated second order SQL injection vulnerability in the custom reports module. ## Technical Details The vulnerability allows attackers with authenticated access to execute malicious SQL queries. This can lead to unauthorized data access or manipulation. The issue arises specifically in the custom reports module, where input validation is insufficient. An attacker can exploit this flaw by crafting specific requests that manipulate the database queries. ## Impact With a CVSS score of 8.8, this vulnerability poses a significant risk to organizations using affected versions. Successful exploitation can compromise sensitive data and lead to further attacks within the network. Organizations should assess their exposure and prioritize remediation efforts. ## Mitigation Defenders should immediately upgrade to ManageEngine ADAudit Plus version 8711 or later. Regularly review and apply security updates to maintain protection against known vulnerabilities. Additionally, implement strict access controls to limit authenticated user privileges where possible.