CVE-2023-48793 is a SQL injection flaw in the aggregate report feature of Zoho ManageEngine ADAudit Plus. The NVD record scores it 9.8 Critical, while the vendor calls the group High and authenticated. Update to build 7271 or later and keep the console off the open internet.
What's affected
- Zoho ManageEngine ADAudit Plus. The NVD record says builds through 7250.
- The vendor security update says all ADAudit Plus builds below 7271 are affected, with the fix in build 7271, released on 12 January 2024. It is applied with the service pack.
- Source conflict on severity and access: the record scores 9.8 Critical with no privileges required, while the vendor labels the group High and describes the SQL injection issues as authenticated. Use the more cautious reading when you decide how fast to move.
- This CVE concerns the aggregate report feature. CVE-2023-48792 is the sibling that concerns the report export option.
- Severity: the record gives CVSS 9.8, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Open the ADAudit Plus console and read the build number from the About page, then compare it with 7271. Any lower build is in the vendor's affected range.
Also confirm where the console is reachable from. A tool that audits Active Directory should sit on a management network, with access limited to a short list of administrators. Check firewall rules and any reverse proxy in front of it.
The vendor notice says the update is applied through the service pack, so check whether your last service pack predates 12 January 2024.
What to do now
- Install the build 7271 service pack, or a later build.
- Limit console access by network and by account, and review the account list.
- Review web server and database logs for odd reporting requests before you patched.
- Rotate credentials stored in or used by the product if you suspect abuse.
- Add ADAudit Plus to your regular patch review so builds do not fall behind.
Why it matters
This is CWE-89 (SQL Injection) again, in a different part of the reporting code. The pattern is the same: user influenced input reaches a database query without being kept separate from the query itself. The standard defence is parameterised queries, which only the vendor can apply inside the product, so your own control is patching and reducing exposure.
Two CVEs in one build suggest the vendor reviewed several reporting paths together. Read the whole notice, not just the one CVE you were alerted to, and make sure the upgrade you run covers all of them.
Quick check
Does the same fix cover both CVE-2023-48792 and CVE-2023-48793?
The vendor notice lists both in the fix for build 7271.
Is it safe to rely on the console being internal?
It reduces risk but does not remove it. The vendor describes authenticated attackers, and internal accounts can be compromised.
Sources
Last reviewed: 19 October 2026.
