What’s Vulnerable › Vulnerabilities
CVE-2021-28958
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 73.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-06-25 · updated 2026-06-17
- Weakness: CWE-78
Description
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
Affected products
- ManageEngine ADSelfService Plus: 4.5-4510, 4.5-4511, 4.5-4520, 4.5-4522, 4.5-4531, 4.5-4540 (+158)
References
- https://blog.stmcyber.com/vulns/cve-2021-28958/
- https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/release-notes.html#6102
- https://blog.stmcyber.com/vulns/cve-2021-28958/
- https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/release-notes.html#6102
Get alerted when CVE-2021-28958 or the next vulnerability affects your stack