CVE-2024-5527 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine ADAudit Plus, in the file auditing configuration. All builds below 8110 are affected. The vendor fixed it in build 8110 on 14 June 2024. Update through the service pack and confirm the build number afterward.
What's affected
ManageEngine's advisory lists every ADAudit Plus build below 8110 as affected, and build 8110 as the fixed version. The vendor gives the fix date as 14 June 2024. NVD agrees on the boundary: versions below 8110.
The weak spot is the file auditing configuration screens. The vendor describes the impact in one sentence: an authenticated adversary could run custom queries and read database table entries through the vulnerable request.
Both the vendor and NVD call this high. NVD scores it 8.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That vector means network reachable, low complexity, a logged-in account required, no user interaction, high confidentiality and integrity impact, and low availability impact.
Same fix build as CVE-2024-5487. The vendor published separate advisories, but one update to build 8110 covers both.
How to check if you're exposed
This is a self-hosted Windows product, so there is no package manager to query. Open the ADAudit Plus web console and read the build number from the product's version information, then compare it with 8110. If the number is lower, you are exposed.
If you run more than one instance, such as a test copy and a production copy, check each one. Test instances are often left several builds behind.
Also list who can sign in. The flaw needs an authenticated user, so the size of your exposure depends on how many accounts can reach the console, and whether any of them are shared or stale. The advisory does not say which roles can reach the vulnerable function, so assume any valid login can until the vendor says otherwise.
For a wider view of what else in your estate runs old builds, the free in-browser dependency scan lets you check a manifest in your browser. It covers libraries your own software depends on, not installed products like this one, so keep a separate inventory for those.
What to do now
- Back up the ADAudit Plus installation and its database before touching anything.
- Download the service pack for build 8110 or later and apply it, following the steps in the vendor advisory.
- Open the console again and confirm the reported build is 8110 or higher.
- Review the accounts that can sign in to ADAudit Plus and remove any that are unused or shared.
- If you cannot update this week, limit network access to the console to the administrators who need it.
Why it matters
CWE-89, SQL injection, happens when user input ends up inside a database query without being kept apart from the query text. The database then treats part of the input as instructions. The vulnerable spot is configuration, not reporting. Settings pages are easy to overlook in reviews because they are used by a few administrators, yet they still talk to the database with values supplied by the person at the keyboard.
ADAudit Plus sits in a sensitive place. It watches Active Directory, file servers and logons, so its database holds a record of who did what across the domain. An attacker who can read that data learns your account names, your lockout patterns and where your sensitive shares live. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and neither the NVD record nor the vendor page reports exploitation. Treat it as a patching task, not an emergency.
Quick check
Do I need to be logged in to be hit by CVE-2024-5527?
Yes. The advisory and the CVSS vector both say authentication is required. The risk comes from any valid account being able to reach the database through the vulnerable feature.
My ADAudit Plus does not audit files. Am I still affected?
The advisory lists all builds below 8110, not only installs that use file auditing. Update regardless, because the vulnerable code ships in the product whether or not you configured that feature.
Sources
Last reviewed: 19 October 2026.
