ManageEngine DataSecurity Plus CVE-2026-18912

Requires an authenticated 'technician'-level account on the ManageEngine DataSecurity Plus web console (PR:L) and access to the Reports module, where a report parameter is injectable. Limiting factors: valid application credentials are mandatory (no unauthenticated path), and the affected instance must be a version before build 6310; exploitation is network-reachable (AV:N) with low complexity (AC:L) and needs no user interaction once a technician session is available. The practical exposure depends on how broadly technician accounts are provisioned and whether the console is reachable by the attacker.

The vendor-assigned CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), driven primarily by the scope-change (S:C) and high confidentiality (C:H) metrics rather than integrity or availability. The realistic risk is materially lower than the raw score suggests because exploitation requires PR:L - an already-authenticated 'technician' account in the DataSecurity Plus console - so this is a post-authentication privilege/data-access issue, not a remote-unauthenticated compromise. No EPSS probability, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis.' I question the S:C (scope change) assignment: a SQL injection typically executes within the application's own database security authority and does not obviously cross into a separately-managed component, which would make S:U more defensible and lower the score. I also note a possible under-scoping on the impact side - the description says the technician can 'execute arbitrary SQL queries,' which usually implies write/DML capability (integrity, I:H) and potential availability impact, yet the vendor set I:N/A:N, suggesting the injection point may be constrained to read-only report queries; verify the exact injection capability with the vendor. Net: a genuine authenticated data-disclosure bug worth patching, but not an emergency-tier internet-exposed threat absent evidence of exploitation.

An attacker who holds (or has phished/compromised) a low-privileged technician login to the ManageEngine DataSecurity Plus web console navigates to the Reports module and injects crafted SQL through a vulnerable report parameter, causing the backend database to execute attacker-controlled queries and return data the technician should not be able to read. No public proof-of-concept is available, and the low attack complexity (AC:L) means exploitation is straightforward once valid technician credentials are obtained.