CVE-2025-41407: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zohocorp ManageEngine ADAudit Plus versions below build 8511 are affected by a high-severity SQL injection vulnerability (CVE-2025-41407). The vulnerability was discovered and fixed on May 09, 2025, specifically impacting the API responsible for retrieving data related to the OU History report (ManageEngine Advisory, NVD).

The vulnerability is classified as a SQL injection (CWE-89) with a CVSS v3.1 base score of 8.3 (High), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The issue specifically affects the API functionality that handles OU History report data retrieval (Wiz Analysis, NVD).

The vulnerability allows an authenticated adversary to execute custom queries and access database table entries using the vulnerable request. This could potentially lead to unauthorized access to sensitive information stored in the database (ManageEngine Advisory).

The vulnerability requires authentication for exploitation, with an exploitation probability percentile (EPSS) of 6.7. No public exploits have been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (Wiz Analysis).

Users are advised to update their ADAudit Plus instance to build 8511 using the service pack. This build contains the fix for the SQL injection vulnerability (ManageEngine Advisory).