What is the CVSS score of CVE-2025-41444?

CVE-2025-41444 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.7%.

Which versions of Zoho are affected by CVE-2025-41444?

ManageEngine ADAudit Plus versions 8510 and prior contain an authenticated SQL injection vulnerability that allows credentialed users to compromise database confidentiality and integrity.. A patch is available.

How to fix or mitigate CVE-2025-41444?

Within 24 hours: Identify all ManageEngine ADAudit Plus instances and document current versions. Within 7 days: Apply vendor-released patch to upgrade all instances beyond version 8510; restrict network access to the alerts module to administrative users only as interim control. Within 30 days: Conduct database integrity audit to detect any unauthorized SQL command execution in logs.

Zoho CVE-2025-41444

EUVD-2025-17450 HIGH

SQL Injection (CWE-89)

2025-06-09 0fc0942c-577d-436f-ae8e-945763c79b02

SQLi Zoho Authentication Bypass Manageengine Adaudit Plus

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8511

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17450

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 12:15 nvd

HIGH 8.3

DescriptionCVE.org

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.

AnalysisAI

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior contain an authenticated SQL injection vulnerability in the alerts module (CWE-89) that allows authenticated users to execute arbitrary SQL commands. An attacker with valid credentials can exploit this network-accessible vulnerability to read sensitive data, modify database contents, or degrade system availability. The CVSS 8.3 score reflects high confidentiality and integrity impact, though authentication is required; real-world exploitation probability and active weaponization status cannot be confirmed without KEV/EPSS data access.

Technical ContextAI

The vulnerability exists in the alerts module of ManageEngine ADAudit Plus, an Active Directory and user access auditing solution commonly deployed in enterprise Windows environments. The root cause is improper input validation/parameterization of SQL queries (CWE-89: SQL Injection) where user-supplied input from alert configuration or filtering parameters is concatenated directly into SQL statements without proper escaping or prepared statement usage. ADAudit Plus is typically deployed as a Java-based application server with backend database (MySQL, MSSQL, or Oracle depending on configuration). CPE would likely be: cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* with version constraint <=8510. The vulnerability is specifically in the alerts module, suggesting the injection point exists in alert query/filtering/management functionality.