ManageEngine ADManager Plus Authenticated Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Custom Script component of ManageEngine ADManager Plus, affecting versions prior to 8024. This vulnerability allows authenticated users to execute arbitrary commands on the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow an authenticated user to execute system commands on the server, potentially leading to unauthorized access to sensitive data or remote code execution.

Remediation

Users are advised to update their ADManager Plus instance to build 8024 or later. Instructions for downloading the latest service pack are available on the ManageEngine website.