ManageEngine Analytics Plus CVE-2025-9428

Exploitation requires an authenticated session (CVSS PR:L) with any low-privilege account on ManageEngine Analytics Plus version 6.1 build 6171 or earlier, and network access to the application's 'key update API' endpoint, which is the specific injection point. No user interaction is required (UI:N) and the vector is network-based (AV:N) with low attack complexity (AC:L). The principal limiting factor is the authentication requirement - an attacker must already possess valid credentials - so unauthenticated internet-wide exploitation is not possible; risk is highest in multi-user deployments, environments with weak credential hygiene, or where the account can be obtained via phishing/credential reuse.

This is a genuine priority, not a high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with CWE-89 against a database-backed BI platform. The signals largely agree: the EPSS score of 27.38% sits in the 98th percentile, which is exceptionally high and indicates substantial exploitation likelihood relative to the broader CVE population, reinforcing the low-complexity authenticated vector. The key tempering factors are that this is NOT on the CISA KEV list (no confirmed active exploitation) and no public exploit code was provided in the input, so the elevated EPSS reflects predicted rather than observed exploitation. The PR:L requirement means an attacker needs valid (even low-privilege) credentials, which narrows the threat to insiders, credential-phishing/stuffing outcomes, or chained access - but in a multi-user analytics deployment this is a low bar. Net: treat as high priority for patching given the full-impact SQLi, high EPSS, and vendor advisory, while noting active exploitation is not confirmed.

An attacker with a low-privilege authenticated account on ManageEngine Analytics Plus (≤6171) sends a crafted request to the key update API containing malicious SQL, which is injected into a backend query. This allows reading, modifying, or destroying database contents - including other users' data and credentials - with full confidentiality, integrity, and availability impact. No public exploit code was identified in the provided data, and exploitation is remote over the network with low complexity.