CVE-2026-1367

HIGH 8.3

SQL Injection

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option.

CWE	CWE-89
Vendor	zohocorp
Product	manageengine adselfservice plus
Published	Feb 23, 2026
Last Updated	Feb 26, 2026

Stay Ahead of the Next One

Get instant alerts for zohocorp manageengine adselfservice plus

Be the first to know when new high vulnerabilities affecting zohocorp manageengine adselfservice plus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

Zohocorp / ManageEngine ADSelfService Plus

0 < 6523

References

NVD ↗ CVE.org ↗ EPSS Data ↗

manageengine.com: https://www.manageengine.com/uk/products/self-service-password/advisory/CVE-2026-1367.html

Credits

Nguyen Dang Toan