ManageEngine ADSelfService Plus vulnerabilities

9 known vulnerabilities in ManageEngine ADSelfService Plus from Zoho. 8 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  manageengine_adselfservice_plus: Improper Authentication

  CVE-2026-11374Jun 23, 2026ZohoEPSS 2.52%

  In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

• 8.4 High severity

  ManageEngine ADSelfService Plus: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2740May 21, 2026ZohoEPSS 1.7%

  Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

• 8.1 High severity

  ADSelfService Plus: Improper Authentication

  CVE-2025-1723Mar 3, 2025ManageEngineEPSS 1.47%

  Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

• 8.8 High severity

  ADSelfService Plus: Improper Control of Generation of Code

  CVE-2024-0252Jan 11, 2024ManageEngineEPSS 7.81%

  ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

• 9.8 Critical severity

  Manageengine Adselfservice Plus: Missing Authentication for Critical Functionality

  CVE-2023-35854Jun 20, 2023ZohoEPSS 5.98%

  Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's

• 9.8 Critical severity

  Zoho ManageEngine Multiple Products Remote Code Execution Exploited

  CVE-2022-47966Jan 18, 2023ZohoEPSS 99.8%

  Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the a

• 8.8 High severity

  Manageengine Adaudit Plus: Insufficiently Protected Credentials

  CVE-2022-29457Apr 18, 2022ZohoEPSS 7.95%

  Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

• 6.8 Medium severity

  Zoho ManageEngine ADSelfService Plus Remote Code Execution Exploited

  CVE-2022-28810Apr 18, 2022ZohoEPSS 71%

  Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be a

• 9.8 Critical severity

  Zoho ManageEngine ADSelfService Plus Authentication Bypass Exploited

  CVE-2021-40539Sep 7, 2021ZohoEPSS 99%

  Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.