Read the docs
TI-2024-23893 Aliases CVE-2024-36036

Insufficient access control in ManageEngine ADAudit Plus

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Fix Fixed ADAudit Plus (ManageEngine): 7270

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ManageEngineADAudit Plusbefore 72707270Patch availableCNA
  • ADAudit Plus VendorManageEngine Affected before 7270 Fixed in 7270 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*before 7.2VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7200:*:*:*:*:*:*7.2 7200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7201:*:*:*:*:*:*7.2 7201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7202:*:*:*:*:*:*7.2 7202VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7203:*:*:*:*:*:*7.2 7203VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7210:*:*:*:*:*:*7.2 7210VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7211:*:*:*:*:*:*7.2 7211VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7212:*:*:*:*:*:*7.2 7212VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7213:*:*:*:*:*:*7.2 7213VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7215:*:*:*:*:*:*7.2 7215VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7200:*:*:*:*:*:* Versions 7.2 7200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7201:*:*:*:*:*:* Versions 7.2 7201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7202:*:*:*:*:*:* Versions 7.2 7202 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7203:*:*:*:*:*:* Versions 7.2 7203 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7210:*:*:*:*:*:* Versions 7.2 7210 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7211:*:*:*:*:*:* Versions 7.2 7211 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7212:*:*:*:*:*:* Versions 7.2 7212 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7213:*:*:*:*:*:* Versions 7.2 7213 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7215:*:*:*:*:*:* Versions 7.2 7215 Vulnerable ·Zohocorp
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7220:*:*:*:*:*:*7.2 7220VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7250:*:*:*:*:*:*7.2 7250VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7251:*:*:*:*:*:*7.2 7251VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7260:*:*:*:*:*:*7.2 7260VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7220:*:*:*:*:*:* Versions 7.2 7220 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7250:*:*:*:*:*:* Versions 7.2 7250 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7251:*:*:*:*:*:* Versions 7.2 7251 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7260:*:*:*:*:*:* Versions 7.2 7260 Vulnerable ·Zohocorp

Remediation

  • Fix · CNA ADAudit Plus (ManageEngine) Fixed in 7270

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ManageEngine ADAudit Plus 7270

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-23894 Insufficient access control in ManageEngine ADAudit PlusPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-36036

References

Advisory 1

  • TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
  • TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
  • TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
  • TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
  • TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences