Weston

**Name of the Vulnerable Software and Affected Versions** Zohocorp ManageEngine ADSelfService Plus versions 6510 and below **Description** The issue is related to session mishandling, which can lead to account takeover. Valid account holders in the setup only have the potential to exploit this bug. The vulnerability allows attackers to bypass authentication safeguards and intercept sensitive user enrollment data when MFA is disabled. This creates a significant risk, potentially allowing malicious actors to impersonate legitimate users and take over accounts. The estimated number of potentially affected devices worldwide is not explicitly mentioned, but over 13,100 services have been found to be vulnerable. **Recommendations** For versions 6510 and below, update to the patched build 6511 to secure sensitive data. As a precaution, enforce MFA for all administrative and user accounts. Consider temporarily disabling the vulnerable session management feature until a patch is available. Restrict access to sensitive user enrollment data to minimize the risk of exploitation. Avoid using the affected ADSelfService Plus software until the issue is resolved.