CVE-2024-5490 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine ADAudit Plus, in the aggregate reports option. All builds below 8000 are affected. The vendor fixed it in build 8000 on 1 March 2024. Update through the service pack and confirm the build number afterward.
What's affected
ManageEngine's advisory lists every ADAudit Plus build below 8000 as affected, and build 8000 as the fixed version. The vendor gives the fix date as 1 March 2024. NVD agrees on the boundary: versions below 8000.
The weak spot is the aggregate reports option. The vendor describes the impact in one sentence: an authenticated adversary could run custom queries and read database table entries through the vulnerable request.
Both the vendor and NVD call this high. NVD scores it 8.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That vector means network reachable, low complexity, a logged-in account required, no user interaction, high confidentiality and integrity impact, and low availability impact.
This is one of the earlier fixes. Build 8000 predates the later injection fixes in builds 8110 and 8121, so being on 8000 does not make you current.
How to check if you're exposed
This is a self-hosted Windows product, so there is no package manager to query. Open the ADAudit Plus web console and read the build number from the product's version information, then compare it with 8000. If the number is lower, you are exposed.
If you run more than one instance, such as a test copy and a production copy, check each one. Test instances are often left several builds behind.
Also list who can sign in. The flaw needs an authenticated user, so the size of your exposure depends on how many accounts can reach the console, and whether any of them are shared or stale. The advisory does not say which roles can reach the vulnerable function, so assume any valid login can until the vendor says otherwise.
For a wider view of what else in your estate runs old builds, the free in-browser dependency scan lets you check a manifest in your browser. It covers libraries your own software depends on, not installed products like this one, so keep a separate inventory for those.
What to do now
- Back up the ADAudit Plus installation and its database before touching anything.
- Download the service pack for build 8000 or later and apply it, following the steps in the vendor advisory.
- Open the console again and confirm the reported build is 8000 or higher.
- Review the accounts that can sign in to ADAudit Plus and remove any that are unused or shared.
- If you cannot update this week, limit network access to the console to the administrators who need it.
Why it matters
CWE-89, SQL injection, happens when user input ends up inside a database query without being kept apart from the query text. The database then treats part of the input as instructions. Aggregate reports roll data up across many records, and the query behind them is assembled from the options a user picks. Anywhere those options reach SQL as text, the same flaw can appear.
ADAudit Plus sits in a sensitive place. It watches Active Directory, file servers and logons, so its database holds a record of who did what across the domain. An attacker who can read that data learns your account names, your lockout patterns and where your sensitive shares live. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and neither the NVD record nor the vendor page reports exploitation. Treat it as a patching task, not an emergency.
Quick check
Do I need to be logged in to be hit by CVE-2024-5490?
Yes. The advisory and the CVSS vector both say authentication is required. The risk comes from any valid account being able to reach the database through the vulnerable feature.
I am on build 8050. Is that safe from CVE-2024-5490?
Yes for this CVE, because 8050 is above the fixed build 8000. But CVE-2024-5527 and CVE-2024-5487 need 8110, and CVE-2024-5586 needs 8121, so 8050 is still behind.
Sources
Last reviewed: 19 October 2026.
