CVE-2021-40539
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 98.96%
- Chance of exploitation in the next 30 days. Higher than 99.93% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Nov 3, 2021
- Weakness
- CWE-706 Use of Incorrectly-Resolved Name or Reference
- CWE-706 Use of Incorrectly-Resolved Name or Reference
- Fix
- None yet
- No fixed version published
Description
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-706: Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-706: Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-69hj-f68j-2879 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path | Medium | Same weakness, CWE-706 |
| GHSA-c48m-32m9-vx93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package | Critical | Same weakness, CWE-706 |
| GHSA-568f-pv23-39p4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML | High | Same weakness, CWE-706 |
| GHSA-7rc3-g7h6-22m7 File Browser: Colliding username normalization gives two users the same home directory | High | Same weakness, CWE-706 |
| GHSA-8788-j68r-3cgh Open WebUI: Any authenticated user can read other users' private notes via Socket.IO | Medium | Same weakness, CWE-706 |
| GHSA-jp82-jpqv-5vv3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname | Medium | Same weakness, CWE-706 |
| GHSA-w727-595x-pc3r pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad | Medium | Same weakness, CWE-706 |
| GHSA-6jwx-7vp4-9847 Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync | High | Same weakness, CWE-706 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor