CVE-2023-49335 is a high severity SQL injection flaw, scored 8.3, in Zoho ManageEngine ADAudit Plus, in the area of getting file server details. Builds earlier than 7271 are affected. Upgrade to build 7271 or later and limit who can sign in to the console.
What's affected
The record says ADAudit Plus versions below 7271 allow SQL injection in this area: getting file server details. ManageEngine's advisory says every ADAudit Plus build earlier than 7271 is affected, and that build 7271, released on 12 January 2024, fixes it. The advisory rates it High, which matches the record's 8.3. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, so the attacker needs valid credentials.
How to check if you're exposed
In the ADAudit Plus console, the build number is shown on the product's About or product information screen. Compare it with 7271. Any build number lower than 7271 is in the affected range.
If you cannot reach the console, check the installed product version in the server's installed programs list. Build numbers on this product are four digit values such as 7271, so the comparison is straightforward.
What to do now
- Read the ADAudit Plus build number and compare it with 7271.
- Apply the build 7271 service pack linked from ManageEngine's advisory page.
- Review which accounts can sign in to the console, and remove accounts that no longer need access, since the flaw needs valid credentials.
- Make sure the console is reachable only from administrative networks.
- Check the same advisory for the other SQL injection CVEs fixed in 7271 and confirm they are closed after the upgrade.
Why it matters
The weakness is SQL injection, CWE-89. User supplied input becomes part of a database query without being kept separate from the query text, so the database can be made to run something the developer did not intend.
The advisory describes the impact as the ability to run custom database queries and read table entries. ADAudit Plus holds audit data about an Active Directory estate, which is the kind of record an attacker would want to read. KEV status is false for this CVE, so this post does not claim exploitation in the wild.
This CVE is one of several published for the same product on the same day for the same fix. The common remedy, build 7271, closes the whole group, which is why one upgrade is better than tracking each CVE separately.
Quick check
Is KEV status relevant?
The record's kev flag is false, so there is no CISA listing of exploitation for this CVE. That does not remove the need to patch.
Does the attacker need credentials?
Yes. The vector shows PR:L, low privileges, and the advisory describes the issues as authenticated SQL injection.
Sources
ManageEngine ADAudit Plus advisory, build 7271 SQL injection fixes
Last reviewed: 19 October 2026.
