Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API…
Priority CRITICAL 100Exploited in the wildCWE-706Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2021-11-17Known ransomware use
EPSS 0.9896 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* | before 6.1 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* | 6.1 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* | 6.1 6100 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* | 6.1 6101 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* | 6.1 6102 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* | 6.1 6103 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* | 6.1 6104 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* | 6.1 6105 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* | 6.1 6106 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:* | 6.1 6113 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 6.1 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* Versions 6.1 6100 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* Versions 6.1 6101 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* Versions 6.1 6102 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* Versions 6.1 6103 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* Versions 6.1 6104 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* Versions 6.1 6105 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* Versions 6.1 6106 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:* Versions 6.1 6113 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-40539
- 2026-10-03 Alias added: GHSA-gww8-rh9f-5mjq
References
More Zoho vulnerabilities
- TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-08210 Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-40539 · CVE Program
- CVE-2021-40539 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-gww8-rh9f-5mjq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences