CVE-2024-5556 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine ADAudit Plus, in the reports module. All builds below 8000 are affected. The vendor fixed it in build 8000 on 1 March 2024. Update through the service pack and confirm the build number afterward.
What's affected
ManageEngine's advisory lists every ADAudit Plus build below 8000 as affected, and build 8000 as the fixed version. The vendor gives the fix date as 1 March 2024. NVD agrees on the boundary: versions below 8000.
The weak spot is the reports module. The vendor describes the impact in one sentence: an authenticated adversary could run custom queries and read database table entries through the vulnerable request.
Both the vendor and NVD call this high. NVD scores it 8.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That vector means network reachable, low complexity, a logged-in account required, no user interaction, high confidentiality and integrity impact, and low availability impact.
It was fixed in the same build 8000 as CVE-2024-5490, though the advisories name different report areas.
How to check if you're exposed
This is a self-hosted Windows product, so there is no package manager to query. Open the ADAudit Plus web console and read the build number from the product's version information, then compare it with 8000. If the number is lower, you are exposed.
If you run more than one instance, such as a test copy and a production copy, check each one. Test instances are often left several builds behind.
Also list who can sign in. The flaw needs an authenticated user, so the size of your exposure depends on how many accounts can reach the console, and whether any of them are shared or stale. The advisory does not say which roles can reach the vulnerable function, so assume any valid login can until the vendor says otherwise.
For a wider view of what else in your estate runs old builds, the free in-browser dependency scan lets you check a manifest in your browser. It covers libraries your own software depends on, not installed products like this one, so keep a separate inventory for those.
What to do now
- Back up the ADAudit Plus installation and its database before touching anything.
- Download the service pack for build 8000 or later and apply it, following the steps in the vendor advisory.
- Open the console again and confirm the reported build is 8000 or higher.
- Review the accounts that can sign in to ADAudit Plus and remove any that are unused or shared.
- If you cannot update this week, limit network access to the console to the administrators who need it.
Why it matters
CWE-89, SQL injection, happens when user input ends up inside a database query without being kept apart from the query text. The database then treats part of the input as instructions. A module full of reports multiplies the number of places where a query is built. One fix in one report does not prove the others are clean, which is why the vendor has shipped several advisories for this product.
ADAudit Plus sits in a sensitive place. It watches Active Directory, file servers and logons, so its database holds a record of who did what across the domain. An attacker who can read that data learns your account names, your lockout patterns and where your sensitive shares live. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and neither the NVD record nor the vendor page reports exploitation. Treat it as a patching task, not an emergency.
Quick check
Do I need to be logged in to be hit by CVE-2024-5556?
Yes. The advisory and the CVSS vector both say authentication is required. The risk comes from any valid account being able to reach the database through the vulnerable feature.
Why are there two advisories for the same build?
Each CVE tracks a separate vulnerable function. CVE-2024-5490 covers aggregate reports and CVE-2024-5556 covers the reports module. Build 8000 fixed both, and later builds fixed other functions.
Sources
Last reviewed: 19 October 2026.
