What’s Vulnerable › Vulnerabilities
CVE-2025-1723: Account takeover
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-03 · updated 2026-06-17
- Weakness: CWE-287
Description
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.
Affected products
- ManageEngine ADSelfService Plus: before 6.5; 6.5-6500, 6.5-6501, 6.5-6502, 6.5-6503, 6.5-6504, 6.5-6505 (+5) — fixed in 6.5
How to fix
Upgrade to a fixed version: ManageEngine ADSelfService Plus 6.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-1723 or the next vulnerability affects your stack