CVE-2025-8309: User privilege escalation vulnerability

Record summary

CVE-2025-8309 has a selected CVSS score of 8.1 (high).

Description

There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 21, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Asset Explorer Browse ManageEngine / Asset Explorer Default status: unaffected	CVE List	Before 7710	affected
ServiceDesk Plus Browse ManageEngine / ServiceDesk Plus Default status: unaffected	CVE List	Before 15110	affected
ServiceDesk Plus MSP Browse ManageEngine / ServiceDesk Plus MSP Default status: unaffected	CVE List	Before 14940	affected
SupportCenter Plus Browse ManageEngine / SupportCenter Plus Default status: unaffected	CVE List	Before 14940	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-8309

manageengine.com

https://www.manageengine.com/products/service-desk/cve-2025-8309.html