Cyber Resilience

CVE-2021-40539

Zohocorp Manageengine Adselfservice Plus ≤ 6.1

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linked
Published
07 September 2021
Modified
05 November 2025
KEV Added
03 November 2021
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.99 99.9th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2021-40539 is a critical-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Zoho ManageEngine ADSelfService Plus versions 6113 and earlier contain a REST API authentication bypass vulnerability that leads directly to remote code execution. The flaw is tracked as CVE-2021-40539 and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without credentials or user interaction. The affected component is the product's REST API handling, classified under CWE-706.

Unauthenticated attackers can send specially crafted requests to the REST endpoints to circumvent authentication controls and obtain the ability to execute arbitrary code on the underlying server. Successful exploitation grants full control over the ManageEngine instance, including access to stored credentials and the ability to pivot within the managed Active Directory environment.

Vendor guidance published by ManageEngine directs administrators to apply the authentication bypass fix for the REST API; the company has released a knowledge-base article detailing the required remediation steps along with updated builds that address the issue. Public exploit code for the vulnerability has also been posted to Packet Storm.

EU & UK References

Vulnerability Data

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

CWE(s)
KEV Date Added
03 November 2021

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1574.008 Path Interception by Search Order Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2022-28810Same product: Zohocorp Manageengine Adselfservice Plusboth on KEV
CVE-2025-11250Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2025-3833Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2025-1723Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2021-33256Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2024-27310Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2021-28958Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2023-35719Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2023-28342Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2024-0252Same product: Zohocorp Manageengine Adselfservice Plus

Affected Assets

zohocorp
manageengine adselfservice plus
6.1 · ≤ 6.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.

PR.AA-05 partial match
prevents

Enforced authorization boundaries limit damage from an incorrectly resolved reference.

PR.IR-01 partial match
prevents

Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.

PR.PS-01 partial match
prevents

Hardened configuration baselines can constrain allowable name-to-resource mappings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.

degrades

Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.

degrades

Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.

prevents

Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.

prevents

Application security requirements can mandate validation of all external references and names used at runtime.

prevents

Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.

References