Cyber Resilience

CVE-2025-9428

High

Published: 21 October 2025

Published
21 October 2025
Modified
23 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0310 87.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9428 is a high-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Analytics Plus. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-9428 is an authenticated SQL injection vulnerability (CWE-89) in Zoho Corp's ManageEngine Analytics Plus versions 6171 and prior. The issue resides in the key update API, enabling malicious SQL queries when improperly handled. Published on 2025-10-21, it carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to network accessibility and significant impact potential.

Low-privileged authenticated users can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation allows attackers to achieve high confidentiality and integrity impacts, such as extracting sensitive data or altering database contents, while causing limited availability disruption within the unchanged scope.

Mitigation details are available in the vendor advisory at https://www.manageengine.com/analytics-plus/CVE-2025-9428.html.

EU & UK References

Vulnerability details

Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Authenticated SQL injection in a network-accessible web API enables exploitation of a public-facing application (T1190) and direct access to extract or manipulate data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26990Same product class: network monitoring / SIEM
CVE-2020-36947Same product class: network monitoring / SIEM
CVE-2025-11250Same product class: network monitoring / SIEM
CVE-2026-26988Same product class: network monitoring / SIEM
CVE-2026-27655Same product class: network monitoring / SIEM
CVE-2026-3880Same product class: network monitoring / SIEM
CVE-2025-11669Same product class: network monitoring / SIEM
CVE-2024-41140Same product class: network monitoring / SIEM
CVE-2025-10020Same product class: network monitoring / SIEM
CVE-2026-28756Same product class: network monitoring / SIEM

Affected Assets

zohocorp
manageengine analytics plus
6.1 · ≤ 6.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection in the key update API by enforcing comprehensive input validation at application entry points.

SI-2 Flaw Remediation good match
prevent

Remediates the specific SQL injection flaw in ManageEngine Analytics Plus versions 6171 and prior through timely patching and configuration updates.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Ensures implementation of vendor advisories and security directives addressing CVE-2025-9428 to prevent exploitation.

References