Critical RCE Vulnerability in Zohocorp ManageEngine Products

## Overview Zohocorp disclosed a critical vulnerability affecting several of its products. CVE-2026-12507 has a CVSS score of 9.1. The vulnerability exists in the Reports module of ManageEngine AssetExplorer and other related products. It allows an authenticated user to execute arbitrary commands on the server. ## Technical Details The vulnerability impacts the following versions: - ManageEngine AssetExplorer versions below 7860 - ServiceDesk Plus versions below 15290 - ServiceDesk Plus MSP versions below 15150 - SupportCenter Plus versions below 15150 An authenticated user with the Create Query Reports permission can exploit this vulnerability. By crafting specific database queries, the user can execute arbitrary commands on the underlying server. ## Impact Successful exploitation of this vulnerability can lead to remote code execution on the affected servers. This poses a significant risk as it allows attackers to gain control over the server environment, potentially leading to data breaches or further system compromise. ## Mitigation Defenders should immediately update their Zohocorp products to the latest versions to mitigate this vulnerability. Regularly review user permissions, especially for those with the Create Query Reports capability. Implement monitoring to detect unusual activities related to report generation and database queries.