ManageEngine ADSelfService Plus vulnerabilities

57 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Exploited ManageEngine ADSelfService Plus vulnerabilities

CVE-2022-28810 — Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
CVE-2021-40539 — Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

CVE-2026-75791 — Authentication bypass vulnerability (CVSS 8.6)
CVE-2026-74849 — Remote code execution vulnerability (CVSS 9.8)
CVE-2026-3183 — Multi Factor Auth Bypass (CVSS 7.1)
CVE-2026-11374 — Account Takeover via Predictable SSO Ticket Generation (CVSS 9.0)
CVE-2026-2740 — Remote Code Execution (CVSS 8.4)
CVE-2026-1367 — SQL Injection (CVSS 8.3)
CVE-2025-11250 — Authentication Bypass (CVSS 9.1)
CVE-2025-3833 — SQL Injection (CVSS 8.1)
CVE-2025-1723 — Account takeover (CVSS 8.1)
CVE-2024-27310 — DOS Vulnerability (CVSS 6.5)
CVE-2024-0252 — Remote code execution (CVSS 8.8)
CVE-2023-6105 — ManageEngine Information Disclosure in Multiple Products (CVSS 5.5)
CVE-2023-35719 — ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability (CVSS 6.8)
CVE-2023-35854 — (CVSS 9.8)
CVE-2023-28342 — (CVSS 7.5)
CVE-2022-36413 — (CVSS 9.1)
CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability (CVSS 9.8) — exploited
CVE-2022-34829 — (CVSS 7.5)
CVE-2022-28987 — (CVSS 5.3)
CVE-2022-29457 — (CVSS 8.8)
CVE-2022-28810 — Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVSS 6.8) — exploited
CVE-2022-24681 — (CVSS 6.1)
CVE-2021-20148 — (CVSS 4.3)
CVE-2021-20147 — (CVSS 5.3)
CVE-2021-37422 — (CVSS 9.8)