CVE-2026-1367: ManageEngine ADSelfService Plus SQLi

CVE-2026-1367 Overview

CVE-2026-1367 is an authenticated SQL Injection vulnerability affecting Zohocorp ManageEngine ADSelfService Plus versions 6522 and below. The vulnerability exists in the search report option functionality, allowing authenticated attackers to inject malicious SQL queries and potentially compromise the underlying database. ManageEngine ADSelfService Plus is a widely deployed self-service password management and single sign-on solution used by enterprises to manage Active Directory identities.

Critical Impact

Authenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data, modify database contents, or potentially escalate privileges within the affected ManageEngine ADSelfService Plus deployment.

Affected Products

• ManageEngine ADSelfService Plus versions 6522 and below
• Zohocorp ManageEngine ADSelfService Plus (all installations running vulnerable versions)

Discovery Timeline

• 2026-02-23 - CVE-2026-1367 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-1367

Vulnerability Analysis

This vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). The flaw exists in the search report option within ManageEngine ADSelfService Plus, where user-supplied input is not properly sanitized before being incorporated into SQL queries. An authenticated user can craft malicious input containing SQL metacharacters that manipulate the intended query logic, enabling unauthorized database operations.

The network-accessible nature of this vulnerability means it can be exploited remotely by any authenticated user with access to the search report functionality. While authentication is required (reducing the attack surface compared to unauthenticated vulnerabilities), the low complexity of exploitation and significant impact on confidentiality and integrity make this a serious security concern.

Root Cause

The root cause of CVE-2026-1367 is inadequate input validation and sanitization in the search report option functionality. The application fails to properly neutralize special SQL characters and metacharacters in user-supplied search parameters before constructing database queries. This allows attackers to break out of the intended query structure and inject arbitrary SQL commands.

The vulnerability follows a classic SQL Injection pattern where dynamic query construction using string concatenation or improper parameterization enables malicious payload injection. Without proper prepared statements or parameterized queries, the database engine cannot distinguish between legitimate query syntax and injected attacker-controlled content.

Attack Vector

The attack vector for CVE-2026-1367 requires an authenticated session to ManageEngine ADSelfService Plus. An attacker with valid credentials navigates to the search report option and submits specially crafted input containing SQL injection payloads. The malicious input is processed by the backend without adequate sanitization, allowing the injected SQL commands to execute against the database.

Typical exploitation techniques include UNION-based injection to extract data from other tables, blind SQL injection using time-based or boolean-based inference, and stacked queries (if supported) to modify or delete data. Given the nature of ADSelfService Plus as an identity management solution, successful exploitation could expose sensitive user information, password hashes, or Active Directory integration credentials.

For technical details on the vulnerability and exploitation methodology, refer to the ManageEngine Security Advisory.

Detection Methods for CVE-2026-1367

Indicators of Compromise

• Unusual or malformed search queries in ADSelfService Plus application logs containing SQL keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, or comment sequences (--, /**/)
• Database error messages in web server logs indicating SQL syntax errors or unexpected query behavior
• Anomalous database query patterns including time-based delays or excessive data retrieval from the ADSelfService Plus database
• Evidence of data exfiltration or unauthorized database modifications in audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in HTTP requests targeting the search report functionality
• Configure application-level logging to capture all search report queries with detailed parameter information for forensic analysis
• Deploy database activity monitoring to identify abnormal query patterns, failed queries, or unauthorized data access attempts
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities that may follow successful SQL injection attacks

Monitoring Recommendations

• Enable verbose logging in ManageEngine ADSelfService Plus to capture request parameters and user activity in the search report module
• Monitor database server performance metrics for anomalies such as unusual CPU spikes or I/O patterns that may indicate blind SQL injection attempts
• Set up alerting for authentication events followed by suspicious search report activity patterns
• Regularly review access logs for the search report functionality to identify potential reconnaissance or exploitation attempts

How to Mitigate CVE-2026-1367

Immediate Actions Required

• Upgrade ManageEngine ADSelfService Plus to a version higher than 6522 that contains the security fix for CVE-2026-1367
• Restrict network access to the ADSelfService Plus web interface to authorized users and networks only using firewall rules
• Review user accounts with access to the search report functionality and apply the principle of least privilege
• Enable enhanced logging and monitoring on affected systems until patching is complete

Patch Information

Zohocorp has released a security update to address CVE-2026-1367. Organizations running ManageEngine ADSelfService Plus versions 6522 or below should upgrade immediately. Detailed patch information and upgrade instructions are available in the ManageEngine Security Advisory.

Workarounds

• If immediate patching is not possible, consider temporarily disabling or restricting access to the search report functionality until the update can be applied
• Implement a Web Application Firewall (WAF) with SQL injection detection rules as an additional layer of defense
• Enforce strict network segmentation to limit exposure of the ADSelfService Plus application to only required users and systems
• Conduct a security review of user accounts with elevated privileges and remove unnecessary access to sensitive functionality

# Example: Restrict access to ADSelfService Plus using iptables
# Allow access only from trusted management network
iptables -A INPUT -p tcp --dport 9251 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9251 -j DROP