What is GHSA-4cwf-239q-xjfq?

GHSA-4cwf-239q-xjfq is a security advisory published by GitHub Security Advisories with Critical severity. Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290,...

Which CVE IDs does GHSA-4cwf-239q-xjfq cover?

GHSA-4cwf-239q-xjfq covers the following CVE IDs: CVE-2026-12507. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4cwf-239q-xjfq?

GHSA-4cwf-239q-xjfq has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-4cwf-239q-xjfqCriticalCVSS 9.1

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290,...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-12507 →

📋 Description

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12507
https://www.manageengine.com/products/service-desk/cve-2026-12507.html
https://github.com/advisories/GHSA-4cwf-239q-xjfq