Unauthenticated Remote Code Execution Vulnerability (CVE-2026-6516) fixed in ADAudit Plus build 8606

Vulnerability details
Severity	Critical
CVE ID	CVE-2026-6516
Affected Software Version(s)	All ADAudit Plus builds below 8606
Fixed Version	Build 8606
Fixed on	April 17, 2026

Vulnerabilities in ADAudit Plus Agent APIs that could allow authentication bypass and path traversal have been fixed.

An unauthenticated adversary could combine these vulnerabilities to potentially achieve remote code execution.

Update your ADAudit Plus instance to the latest version — 8606 — using the service pack.
If your Windows agent version is earlier than 7060, upgrade the agent by following the steps on this page.
- To check the agent version, open the ADAudit Plus web console and navigate to: Configuration → Agent Management → Manage → Installed Version column.
If you have Mac agents installed, upgrade them to the latest version by following the steps on this page, regardless of the current version.

This issue was reported by Linhlt of VCB.

Please contact support@adauditplus.com for more details.

Security Updates