What is the CVSS score of CVE-2025-36528?

CVE-2025-36528 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.7%.

Which versions of Zoho are affected by CVE-2025-36528?

ManageEngine ADAudit Plus versions 8510 and earlier contain an authenticated SQL injection vulnerability that allows low-privileged users to execute arbitrary database queries, potentially exposing…. A patch is available.

How to fix or mitigate CVE-2025-36528?

Within 24 hours: Identify all ManageEngine ADAudit Plus installations and document current versions. Within 7 days: Apply vendor-released patch to upgrade all instances above version 8510. Within 30 days: Audit database access logs for suspicious SQL query patterns using affected accounts and validate audit log integrity post-patching.

Zoho CVE-2025-36528

EUVD-2025-17451 HIGH

SQL Injection (CWE-89)

2025-06-09 0fc0942c-577d-436f-ae8e-945763c79b02

SQLi Zoho Information Disclosure Manageengine Adaudit Plus

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8511

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17451

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 11:15 nvd

HIGH 8.3

DescriptionCVE.org

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.

AnalysisAI

CVE-2025-36528 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus versions 8510 and earlier, affecting the Service Account Auditing reports functionality. An authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure, data modification, or partial denial of service. With a CVSS score of 8.3 and network-accessible attack vector, this represents a significant risk to organizations using affected versions, particularly in environments where administrative audit logs contain sensitive credentials and access patterns.

Technical ContextAI

CVE-2025-36528 exploits CWE-89 (SQL Injection) within ManageEngine ADAudit Plus, a privileged account governance and auditing solution that monitors Active Directory and service account activities. The vulnerability exists in the Service Account Auditing reports module, which likely constructs SQL queries dynamically using unsanitized user input from report filters or parameters. ADAudit Plus uses a backend database (typically SQL Server or MySQL depending on deployment) to store audit logs and configuration data. The root cause is insufficient input validation and parameterized query usage in the reporting engine, allowing attackers to break out of intended SQL query syntax and inject malicious commands. This is particularly dangerous given ADAudit Plus's role in storing sensitive credential audit trails and access logs.

RemediationAI

Immediate remediation steps: (1) Upgrade ManageEngine ADAudit Plus to version 8511 or later (patch version details should be confirmed via Zohocorp security advisory); (2) If immediate patching is not feasible, implement network-level access controls restricting access to the ADAudit Plus web interface and APIs to trusted administrative networks only; (3) Disable or restrict access to Service Account Auditing reports for non-administrative users; (4) Implement database-level SQL query logging and intrusion detection signatures to monitor for SQL injection attempts (look for SQL keywords: UNION, SELECT, INSERT, DROP, etc. in report parameters); (5) Enforce strong authentication (multi-factor authentication) for ADAudit Plus user accounts to reduce insider threat risk. Consult Zohocorp's official security advisory at 'https://www.manageengine.com/adaudit-plus/security-advisory.html' (expected location for vendor advisories) for patch availability and detailed upgrade procedures.