CVE-2026-18912

HighCVSS 7.7

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.50%

73th percentile - higher than 73% of all known CVEs

Summary

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability. An authenticated technician can execute arbitrary SQL queries through the Reports module.

Risk Assessment

An authenticated technician can read or modify sensitive data in the database, potentially leading to information leakage and data integrity violations.

Recommendation

Update ManageEngine DataSecurity Plus to version 6310 or later to eliminate the vulnerability.

Other vulnerabilities in ManageEngine DataSecurity Plus

CVE-2026-18911High
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

Original NVD description (English source)

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS