ManageEngine ADManager Plus CVE-2025-10020

Exploitation requires an authenticated session to the ManageEngine ADManager Plus web interface (PR:L) with access to the Custom Script component, and the affected instance must be running a build earlier than 8024. The specific prerequisite is the ability to supply or modify input to the Custom Script automation feature, which is then injected into an OS command. Limiting factors: the attacker must already hold valid credentials and sufficient role access to reach the Custom Script function, no unauthenticated path exists, and instances already upgraded to build 8024 or later are not affected; no user interaction by a second party is required (UI:N).

This is a credible, above-average priority issue but not a top-tier emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity command injection yielding full confidentiality, integrity, and availability impact - but it explicitly requires privileges (PR:L), meaning the attacker must already be authenticated, which materially lowers the real-world threat versus an unauthenticated RCE. The EPSS score of 4.54% sits at the 91st percentile, which is elevated relative to the average CVE and signals meaningful exploitation interest, yet an absolute probability under 5% is far from imminent mass exploitation. There is no CISA KEV listing and no public exploit was identified in the provided data, so there is no confirmed active exploitation. The signals are broadly consistent (high-impact, low-complexity, authenticated) rather than conflicting; the main nuance is that the authentication requirement plus the fact that the vulnerable 'Custom Script' feature is an administrative/automation capability likely narrows the realistic attacker pool to users who already hold some privileged access to the ADManager Plus console. Because ADManager Plus manages Active Directory, successful exploitation is high-value (OS-level code execution on a host with AD administrative reach), so prompt patching to build 8024 is warranted even though this is not an unauthenticated internet-facing bug.

An attacker who has obtained valid (even low-privileged) credentials to the ManageEngine ADManager Plus web console navigates to the Custom Script component and supplies crafted input that is passed unsafely to the underlying OS command interpreter. The injected commands execute in the context of the ADManager Plus service account, giving the attacker arbitrary command execution on the server that administers Active Directory. No public proof-of-concept was identified at the time of analysis, and user interaction is not required (UI:N).