Zoho · ManageEngine

CVE-2021-40539

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 99%

What it is

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

CISA: Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: September 7, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99% in the top 0.1% of all known vulnerabilities
Weakness: CWE-55
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Zoho

Added	Vulnerability	Product	Severity	Attack chance
Mar 7, 2023	ADSelfService Plus Remote Code ExecutionCVE-2022-28810	ManageEngine	Medium 6.8	71%
Jan 23, 2023	Multiple Products Remote Code ExecutionCVE-2022-47966used by ransomware	ManageEngine	Critical 9.8	99.8%
Sep 22, 2022	Multiple Products Remote Code ExecutionCVE-2022-35405	ManageEngine	Critical 9.8	99.9%
Nov 3, 2021	ServiceDesk Plus (SDP) File UploadCVE-2019-8394	ManageEngine	High 7.5	63%
Nov 3, 2021	Desktop Central File UploadCVE-2020-10189	ManageEngine	Critical 9.8	99.9%
Dec 10, 2021	Authentication BypassCVE-2021-44515	Desktop Central	Critical 9.8	99.9%
Dec 1, 2021	ManageEngine ServiceDesk Authentication BypassCVE-2021-37415	ManageEngine ServiceDesk Plus (SDP)	Critical 9.8	99.8%
Dec 1, 2021	ManageEngine ServiceDesk Plus Remote Code ExecutionCVE-2021-44077	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Critical 9.8	93%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.