# CVE-2026-12507: Zohocorp ManageEngine remote code execution in Reports module

Source: https://junglewise.ai/threats/cve-2026-12507-zohocorp-manageengine-assetexplorer-versions-below-7860  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-12507 · Severity: critical · CVSS 9.1 · Published 2026-11-12

ManageEngine IT management products contain a remote code execution flaw in the Reports module that allows authenticated users with specific permissions to execute arbitrary commands on the server through specially crafted database queries. An attacker with Create Query Reports permission can exploit this to gain full control of the underlying server and launch further attacks on corporate IT infrastructure.

Vendors: [Zohocorp](https://junglewise.ai/threats/vendors/zohocorp).

## Quick answers

**Is CVE-2026-12507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12507 being exploited in the wild.

**How severe is CVE-2026-12507?** Critical severity, with a CVSS score of 9.1, published 12 November 2026.

**Which products and versions are affected?** Zohocorp ManageEngine AssetExplorer 7850 and below; Zohocorp ManageEngine ServiceDesk Plus 15280 and below; Zohocorp ManageEngine ServiceDesk Plus MSP 15140 and below; Zohocorp ManageEngine SupportCenter Plus 15140 and below.

**Is there a fix for CVE-2026-12507?** Yes: fixed in AssetExplorer 7860, ServiceDesk Plus 15290, ServiceDesk Plus MSP 15150, SupportCenter Plus 15150. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12507 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-12507?** Check whether you run Zohocorp ManageEngine AssetExplorer, Zohocorp ManageEngine ServiceDesk Plus, Zohocorp ManageEngine ServiceDesk Plus MSP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in AssetExplorer 7860, ServiceDesk Plus 15290, ServiceDesk Plus MSP 15150, SupportCenter Plus 15150

## Technical details

The vulnerability exists in the Reports module's handling of database queries containing Jasper expressions; authenticated users with Create Query Reports permission can craft queries that bypass input validation and execute arbitrary system commands. The flaw affects AssetExplorer (≤7850), ServiceDesk Plus (≤15280), ServiceDesk Plus MSP (≤15140), and SupportCenter Plus (≤15140). The fix restricts user input validation to prevent Jasper expression evaluation during query execution.

## Affected products

- Zohocorp ManageEngine AssetExplorer 7850 and below
- Zohocorp ManageEngine ServiceDesk Plus 15280 and below
- Zohocorp ManageEngine ServiceDesk Plus MSP 15140 and below
- Zohocorp ManageEngine SupportCenter Plus 15140 and below

## Timeline

- 2026-11-12: disclosed
- 2026-06-19: patched: AssetExplorer, ServiceDesk Plus patched
- 2026-06-22: patched: ServiceDesk Plus MSP, SupportCenter Plus patched

## References

- [https://www.manageengine.com/products/service-desk/cve-2026-12507.html](https://www.manageengine.com/products/service-desk/cve-2026-12507.html)