CVE-2025-3833: ManageEngine ADSelfService Plus authenticated SQL injection in MFA reports

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (8.1) with high confidentiality and integrity impact and very high EPSS, though it requires authentication and no active exploitation is documented.

What it is

ManageEngine ADSelfService Plus versions 6513 and prior contain an authenticated SQL injection flaw in the MFA reports component. A logged-in user can inject SQL through that reporting interface, which matters because it exposes backend data and integrity to a low-privileged account.

Impact

An authenticated attacker can read and modify data reachable by the application's database queries, giving high confidentiality and integrity impact. Availability is not affected per the CVSS vector.

Attack surface

Reachable over the network through the MFA reports feature; the CVSS vector shows low privileges required and no user interaction. Authentication is required, so the attacker needs a valid account.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record. EPSS is 0.45156 (98.7th percentile), indicating elevated predicted exploitation likelihood.

What to do

• Upgrade ADSelfService Plus to a version later than 6513 per the vendor advisory.
• If immediate upgrade is not possible, restrict access to the MFA reports feature to trusted administrators only.
• Review and minimize accounts with access to MFA reporting to reduce the authenticated attack surface.
• Monitor database and application logs for anomalous SQL in MFA report requests.
• Apply least-privilege permissions to the database account used by ADSelfService Plus.

Detection

• Search application and web logs for SQL metacharacters or UNION/boolean patterns in MFA report parameters.
• Alert on MFA report queries returning unusually large result sets or errors from malformed SQL.
• Baseline normal MFA report usage per account and flag deviations from low-privileged users.
• Correlate database audit logs with ADSelfService Plus report activity for unexpected table access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.