Dashboard / CVE-2025-8309

CVE-2025-8309

HIGH
MEDIUM Priority: 0.02 BB Relevance: 66/100
Published: 2025-08-20 Modified: 2026-11-04 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: None

Description

There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
ManageEngine Asset Explorer 0 < 7710
ManageEngine Asset Explorer 0 < 7710
ManageEngine ServiceDesk Plus 0 < 15110
ManageEngine ServiceDesk Plus 0 < 15110
ManageEngine ServiceDesk Plus MSP 0 < 14940
ManageEngine ServiceDesk Plus MSP 0 < 14940
ManageEngine SupportCenter Plus 0 < 14940
ManageEngine SupportCenter Plus 0 < 14940

References & Advisories (1)

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002710
Percentile 19.5%
Date 2026-11-04

EPSS Trend

2026-11-04
0.00271
2026-11-03
0.00271

Intelligence Sources

mitre ref →

External Links