FlagThis
← Back to CVE List
Vulnerability Intelligence Report
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

CISA KEV Nuclei Template SSVC: Active Exploitation Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:98.96%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-706 ↗CWE-706 Use of Incorrectly-Resolved Name or Reference

Affected Products & Versions

Vendor Product Affected Versions
zohocorp manageengine_adselfservice_plus 6.1

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
98.960%
GitHub Advisory
GHSA-gww8-rh9f-5mjq ↗

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityMITRE Corporation · N/A · USA
Reserved2021-09-06T00:00:00
Published2021-09-07T16:06:58
Last Updated2025-10-21T23:25:35

Related Intelligence

Related CVEs
CVE-2019-3905 CVSS 10.0 — Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
CVE-2023-35854 CVSS 9.8 — Zoho ManageEngine ADSelfService Plus through 6113 has an authenticatio…
CVE-2021-37422 CVSS 9.8 — Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to S…
CVE-2021-37423 CVSS 9.8 — Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to l…
CVE-2021-37421 CVSS 9.8 — Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to a…
LINK COPIED TO CLIPBOARD