PT-2021-4466 · Zoho · Zoho Manageengine Adselfservice Plus

Published 2021-09-07 · Updated 2026-04-06 · CVE-2021-40539

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6113 and prior.

Description Zoho ManageEngine ADSelfService Plus is susceptible to a REST API authentication bypass, potentially leading to remote code execution. This issue has been actively exploited in attacks by threat actors, including the Trigona ransomware group and APT27. Reports indicate exploitation of this vulnerability in attacks against organizations in the United States and Europe, impacting sectors like communications, water, energy, and transportation. The Red Cross experienced a breach where this vulnerability was used for initial access, allowing attackers to masquerade as legitimate users and steal data. The vulnerability stems from a missing authentication procedure. Exploitation code is publicly available.

Recommendations Update ManageEngine ADSelfService Plus to the latest version to address this issue.

Exploit

Fix

RCE

Improper Authentication

Weakness Enumeration

CWE-706

CWE-287

Related Identifiers

BDU:2021-05099

CVE-2021-40539

Affected Products

Zoho Manageengine Adselfservice Plus

References · 79

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.rb · Exploit
• 🔥 https://github.com/synacktiv/CVE-2021-40539 · Exploit
• 🔥 http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html · Exploit
• https://manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40539 · Vendor Advisory
• https://manageengine.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40539 · Security Note
• https://bdu.fstec.ru/vul/2021-05099 · Security Note
• https://github.com/xx0hcd/Malleable-C2-Profiles · Note
• https://github.com/rivitna/APT · Note
• https://twitter.com/TrendMicroRSRCH/status/1734424110950928554 · Twitter Post
• https://t.me/true_secator/2672 · Telegram Post
• https://t.me/poxek/1255 · Telegram Post
• https://t.me/irozysk/6018 · Telegram Post
• https://twitter.com/fletch_ai/status/1755835681006391352 · Twitter Post