CVE-2025-36527: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

A high-severity SQL injection vulnerability was identified in Zohocorp ManageEngine ADAudit Plus affecting all versions below build 8511. The vulnerability (CVE-2025-36527) was discovered by security researcher minhgalaxy and was fixed on May 09, 2025. The vulnerability affects an API responsible for exporting ADAudit Plus reports (Wiz, ManageEngine).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has received a HIGH severity rating with a CVSS v3.1 base score of 8.3. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating network accessibility, low attack complexity, and required low privileges for exploitation (NVD, Wiz).

This vulnerability could allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request. The potential impact includes unauthorized access to sensitive database information and possible manipulation of data (ManageEngine).

Users are advised to update their ADAudit Plus instance to build 8511 using the service pack, which contains the fix for the SQL injection vulnerability. This is the primary and recommended mitigation strategy (ManageEngine).

The vulnerability was part of a larger security update from ManageEngine in May 2025, which addressed multiple SQL injection vulnerabilities across their product suite (Wiz).