CVE-2026-12507

Name of the Vulnerable Software and Affected Versions ManageEngine AssetExplorer versions prior to 7860 ManageEngine ServiceDesk Plus versions prior to 15290 ManageEngine ServiceDesk Plus MSP versions prior to 15150 ManageEngine SupportCenter Plus versions prior to 15150

Description An authenticated remote code execution flaw exists in the Reports module. An authenticated user possessing the Create Query Reports permission can execute arbitrary operating system commands on the underlying server by using specially crafted database queries.

Recommendations Update ManageEngine AssetExplorer to version 7860 or later. Update ManageEngine ServiceDesk Plus to version 15290 or later. Update ManageEngine ServiceDesk Plus MSP to version 15150 or later. Update ManageEngine SupportCenter Plus to version 15150 or later.