Introduction
A critical flaw in the Custom Script component of ManageEngine ADManager Plus lets authenticated users execute arbitrary operating system commands on the server. The vulnerability, tracked as CVE-2025-10020, affects all versions before Build 8025. An attacker who exploits it can gain full control of the application server.
About ManageEngine and ADManager Plus:
ManageEngine, a division of Zoho Corporation, is a major provider of IT management and security software with customers around the world. ADManager Plus is an Active Directory management and reporting tool that is widely used in enterprise environments. It includes automation and delegation features for identity and access management. Because it is deployed so broadly, a vulnerability in it can have a significant impact across industries.
Technical Information
CVE-2025-10020 is an authenticated command injection vulnerability in the Custom Script component of ManageEngine ADManager Plus, present in all versions prior to Build 8025. The cause is improper input validation (CWE-77: Improper Neutralization of Special Elements used in a Command) in the Custom Script functionality. An authenticated user with access to this feature can supply specially crafted input that goes directly into system command execution without sufficient sanitization. The injected commands then run with the privileges of the ADManager Plus service account.
The Custom Script component exists so administrators can automate tasks with user-defined scripts. Because it does not handle input properly, any parameter passed to these scripts could be manipulated to inject additional commands. That could lead to remote code execution, data theft, privilege escalation, or lateral movement within the network. Only authenticated users can exploit the vulnerability. In environments where multiple technicians or delegated administrators have access, though, the risk of credential compromise or insider abuse is significant.
No public code snippets or proof-of-concept details are available at the time of writing. The root cause is that the Custom Script component passes unsanitized user input directly to command execution APIs or shell invocations.
Patch Information
ManageEngine has released Build 8025 to fix CVE-2025-10020. The update corrects how custom scripts handle user input. Before the fix, that input allowed authenticated users to execute arbitrary commands on the server, potentially leading to remote code execution (RCE). Build 8025 sanitizes and validates these inputs, which mitigates the vulnerability. Users are strongly advised to apply the update promptly.
References:
- https://www.manageengine.com/products/ad-manager/release-notes.html
- https://www.manageengine.jp/support/kb/ADManager_Plus/?p=6166
Affected Systems and Versions
- Product: ManageEngine ADManager Plus
- Affected versions: All versions before Build 8025
- Vulnerable component: Custom Script functionality
- Only installations that allow authenticated users to create or execute custom scripts are directly exposed
Vendor Security History
ManageEngine has previously fixed several high-severity vulnerabilities in its products:
- CVE-2021-42002: Authentication bypass in ADManager Plus, allowing remote code execution
- CVE-2021-28960: Unauthenticated command injection in Desktop Central
The vendor usually releases patches and advisories promptly. Recurring command injection issues, however, point to a persistent problem with secure input handling across its products.
