CVE-2024-5586 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine ADAudit Plus, in the extranet lockouts report. All builds below 8121 are affected. The vendor fixed it in build 8121 on 19 August 2024. Update through the service pack and confirm the build number afterward.
What's affected
ManageEngine's advisory lists every ADAudit Plus build below 8121 as affected, and build 8121 as the fixed version. The vendor gives the fix date as 19 August 2024. NVD agrees on the boundary: versions below 8121.
The weak spot is the extranet lockouts report. The vendor describes the impact in one sentence: an authenticated adversary could run custom queries and read database table entries through the vulnerable request.
Both the vendor and NVD call this high. NVD scores it 8.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That vector means network reachable, low complexity, a logged-in account required, no user interaction, high confidentiality and integrity impact, and low availability impact.
Build 8121 is the newest fixed build among the five ADAudit Plus injection advisories in this CVE range, so updating to it or later clears the others too.
How to check if you're exposed
This is a self-hosted Windows product, so there is no package manager to query. Open the ADAudit Plus web console and read the build number from the product's version information, then compare it with 8121. If the number is lower, you are exposed.
If you run more than one instance, such as a test copy and a production copy, check each one. Test instances are often left several builds behind.
Also list who can sign in. The flaw needs an authenticated user, so the size of your exposure depends on how many accounts can reach the console, and whether any of them are shared or stale. The advisory does not say which roles can reach the vulnerable function, so assume any valid login can until the vendor says otherwise.
For a wider view of what else in your estate runs old builds, the free in-browser dependency scan lets you check a manifest in your browser. It covers libraries your own software depends on, not installed products like this one, so keep a separate inventory for those.
What to do now
- Back up the ADAudit Plus installation and its database before touching anything.
- Download the service pack for build 8121 or later and apply it, following the steps in the vendor advisory.
- Open the console again and confirm the reported build is 8121 or higher.
- Review the accounts that can sign in to ADAudit Plus and remove any that are unused or shared.
- If you cannot update this week, limit network access to the console to the administrators who need it.
Why it matters
CWE-89, SQL injection, happens when user input ends up inside a database query without being kept apart from the query text. The database then treats part of the input as instructions. Lockout reports are queried often during incidents, which is when an attacker would be active too. Keeping that screen clean matters most at exactly the moment people rely on it.
ADAudit Plus sits in a sensitive place. It watches Active Directory, file servers and logons, so its database holds a record of who did what across the domain. An attacker who can read that data learns your account names, your lockout patterns and where your sensitive shares live. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and neither the NVD record nor the vendor page reports exploitation. Treat it as a patching task, not an emergency.
Quick check
Do I need to be logged in to be hit by CVE-2024-5586?
Yes. The advisory and the CVSS vector both say authentication is required. The risk comes from any valid account being able to reach the database through the vulnerable feature.
What is the extranet lockouts report?
It is the ADAudit Plus report that shows account lockouts coming from outside the corporate network. The advisory names it as the place the injection was fixed. Check the vendor documentation for how your team uses it.
Sources
Last reviewed: 19 October 2026.
