Cyber Posture

CVE-2025-9428

High

Published: 21 October 2025

Published
21 October 2025
Modified
23 October 2025
KEV Added
—
Patch
—
CVSS Score 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0100 77.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9428 is a high-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Analytics Plus. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection in the key update API by enforcing comprehensive input validation at application entry points.

SI-2 Flaw Remediation good match
prevent

Remediates the specific SQL injection flaw in ManageEngine Analytics Plus versions 6171 and prior through timely patching and configuration updates.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Ensures implementation of vendor advisories and security directives addressing CVE-2025-9428 to prevent exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Authenticated SQL injection in a network-accessible web API enables exploitation of a public-facing application (T1190) and direct access to extract or manipulate data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.

Deeper analysisAI

CVE-2025-9428 is an authenticated SQL injection vulnerability (CWE-89) in Zoho Corp's ManageEngine Analytics Plus versions 6171 and prior. The issue resides in the key update API, enabling malicious SQL queries when improperly handled. Published on 2025-10-21, it carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to network accessibility and significant impact potential.

Low-privileged authenticated users can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation allows attackers to achieve high confidentiality and integrity impacts, such as extracting sensitive data or altering database contents, while causing limited availability disruption within the unchanged scope.

Mitigation details are available in the vendor advisory at https://www.manageengine.com/analytics-plus/CVE-2025-9428.html.

Details

CWE(s)
CWE-89

Affected Products

zohocorp
manageengine analytics plus
6.1 · ≤ 6.1

CVEs Like This One

CVE-2026-26990Same product class: network monitoring / SIEM
CVE-2025-11250Same product class: network monitoring / SIEM
CVE-2026-4108Same product class: network monitoring / SIEM
CVE-2026-28756Same product class: network monitoring / SIEM
CVE-2012-10063Same product class: network monitoring / SIEM
CVE-2025-11669Same product class: network monitoring / SIEM
CVE-2026-3880Same product class: network monitoring / SIEM
CVE-2026-28754Same product class: network monitoring / SIEM
CVE-2026-3879Same product class: network monitoring / SIEM
CVE-2025-1723Same product class: network monitoring / SIEM

References