CVE-2026-1367 - Vulnerability Analysis

Overview

Zohocorp ManageEngine ADSelfService Plus <= 6522 contains an authenticated SQL Injection caused by improper input sanitization in the search report option, letting authenticated attackers execute arbitrary SQL commands.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to a version later than 6522 or the latest available version.

References

• https://www.manageengine.com/uk/products/self-service-password/advisory/CVE-2026-1367.html

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 23, 2026

🟠 CVE-2026-1367 - High (8.3) Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1367/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner