What’s Vulnerable › Vulnerabilities
CVE-2021-40539: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-11-03
- EPSS: 99.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-09-07 · updated 2026-06-17
- Weakness: CWE-706
Description
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Affected products
- ManageEngine ADSelfService Plus: before 6.1; 6.1, 6.1-6100, 6.1-6101, 6.1-6102, 6.1-6103, 6.1-6104 (+3) — fixed in 6.1
How to fix
Upgrade to a fixed version: ManageEngine ADSelfService Plus 6.1. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539
Get alerted when CVE-2021-40539 or the next vulnerability affects your stack