Remote code execution in ManageEngine ADSelfService Plus
Priority MEDIUM 51CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07814 94th percentileScored 2026-11-07
Fix Fixed ADSelfService Plus (ManageEngine): 6402
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ManageEngine | ADSelfService Plus | before 6402 | 6402 | Patch available | CNA |
- ADSelfService Plus VendorManageEngine Affected before 6402 Fixed in 6402 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* | before 6.4 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400:*:*:*:*:*:* | 6.4 6400 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401:*:*:*:*:*:* | 6.4 6401 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 6.4 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400:*:*:*:*:*:* Versions 6.4 6400 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401:*:*:*:*:*:* Versions 6.4 6401 Vulnerable ·Zohocorp
Remediation
- Fix · CNA ADSelfService Plus (ManageEngine) Fixed in 6402
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0252
- 2026-10-03 Alias added: GHSA-fh24-44w6-495r
References
More ManageEngine vulnerabilities
- TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
- TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
- TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
- TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
- TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
- TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
Sources
- CVE-2024-0252 · CVE Program
- CVE-2024-0252 · NVD
- FIRST EPSS
- GHSA-fh24-44w6-495r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences