Read the docs
TI-2023-17929 Aliases CVE-2023-35854GHSA-vwhx-3qh6-75xf

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can…

Priority MEDIUM 52CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05979 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*before 6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*6.1 6100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*6.1 6101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*6.1 6102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*6.1 6103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*6.1 6104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*6.1 6105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*6.1 6106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*6.1 6107VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* Versions 6.1 6100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* Versions 6.1 6101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* Versions 6.1 6102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* Versions 6.1 6103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* Versions 6.1 6104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* Versions 6.1 6105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* Versions 6.1 6106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:* Versions 6.1 6107 Vulnerable ·Zohocorp
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*6.1 6108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*6.1 6109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*6.1 6110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*6.1 6111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*6.1 6112VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:* Versions 6.1 6108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:* Versions 6.1 6109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:* Versions 6.1 6110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:* Versions 6.1 6111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:* Versions 6.1 6112 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35854
  2. 2026-10-03 Alias added: GHSA-vwhx-3qh6-75xf

References

Advisory 1

Other 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-11432 Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated… KEVCVSS 3.1MEDIUM 6.8
  • TI-2021-09883 Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote… CVSS 3.1CRITICAL 9.8
  • TI-2023-12890 Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a… CVSS 3.1HIGH 7.5
  • TI-2021-12772 A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus… CVSS 3.1HIGH 8.8
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences