{"id":"CVE-2021-40539","kind":"vulnerability","aliases":["CVE-2021-40539"],"related":[],"title":"Zoho ManageEngine: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","description":"Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Zoho ManageEngine ADSelfService Plus has an authentication bypass in its REST API URLs that lets an unauthenticated attacker reach features that allow remote code execution. Attackers are exploiting it in the wild and it has been used in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.9896,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Zoho ManageEngine","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ADSelfService Plus","fixed":["build 6114"],"affected":"<= build 6113","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adselfservice-plus","exploited","manageengine","ransomware","self-hosted","vendor","windows"],"not_affected_if":["not-running-adselfservice-plus"],"how_to_check":"Run vendor RCEScan.bat from ADSelfService Plus\\bin as admin. Search \\ManageEngine\\ADSelfService Plus\\logs access_log files for '/../RestAPI' or '/./RestAPI'; check serverOut and adslog for NullPointerException in addSmartCardConfig/getSmartCardConfig. Look for bin\\service.cer, ReportGenerate.jsp, webapps\\adssp\\help\\html\\promotion\\adap.jsp and selfsdp.jspx, html\\error.jsp, lib\\tomcat-ant.jar, C:\\Users\\Public\\custom.bat/custom.txt.","fix":"Update to ADSelfService Plus build 6114 or later via service pack. If compromised: disconnect, rebuild machine from backup on a clean host, then update and reset potentially exposed AD account passwords.","status":"open","published_at":"2021-09-07T17:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:31+00:00","updated_at":"2026-10-23T20:30:48+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T20:29:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update per the vendor instructions; the fixed version is not stated in the sources.\nunknown","summary":"Zoho ManageEngine ADSelfService Plus has an authentication bypass in its REST API URLs that lets an unauthenticated attacker reach features that allow remote code execution. Attackers are exploiting it in the wild and it has been used in ransomware campaigns.","category":"vendor","who_cares":["manageengine","adselfservice-plus","windows","self-hosted"],"confidence":0.7,"analyst_note":"Find the fixed ADSelfService Plus build and the vendor advisory and a detection method (log paths or URL patterns) at the NVD and CISA KEV pages listed in the sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-adselfservice-plus"],"severity_if_unknown":"critical"},"cost_usd":0.000366,"input_tokens":2119,"output_tokens":309,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed ADSelfService Plus build and the vendor advisory and a detection method (log paths or URL patterns) at the NVD and CISA KEV pages listed in the sources.","search":"'-2021':11A,14A '-40539':12A,15A 'action':93C 'adselfservic':5A,21B,33B,73C 'adselfservice':18A 'adselfservice-plus':20B 'affect':80C 'allow':52B,86C 'api':42B,83C 'appli':94C 'attack':48B,56B 'authent':7A,37B,77C 'bypass':8A,38B,78C 'campaign':70B 'cisa':91C 'code':54B,89C 'contain':75C 'cve':10A,13A 'execut':55B,90C 'exploit':23B,58B 'featur':50B 'host':28B 'instruct':98C 'let':45B 'manageengin':2A,4A,24B,32B,72C 'manageengine':17A 'per':96C 'plus':6A,19A,22B,34B,74C 'ransomwar':25B,69B 'reach':49B 'remot':53B,88C 'requir':92C 'rest':41B,82C 'self':27B 'self-host':26B 'unauthent':47B 'updat':95C 'url':43B,84C 'use':67B 'vendor':29B,97C 'vulner':9A,79C 'wild':62B 'window':30B 'zoho':1A,3A,16A,31B,71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-07T17:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-40539","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40539","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:33+00:00","note":null},{"source":"epss","external_id":"CVE-2021-40539","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40539","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-40539","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40539","severity":null,"published_at":"2021-09-07T17:15:07+00:00","modified_at":"2026-06-17T04:07:06+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-40539:16","url":null,"severity":null,"published_at":"2026-10-23T20:30:48+00:00","modified_at":"2026-10-23T20:30:48+00:00","first_seen_at":"2026-10-23T20:30:48+00:00","fetched_at":"2026-10-23T20:30:48+00:00","note":"Read vendor advisory: affected builds <=6113, fixed in build 6114 (Sep 7 2021); detection via log strings and file IoCs. Exploitation per CISA KEV (from triage); public PoC link not checked."}],"documents":[{"id":839,"url":"https://www.manageengine.com/products/self-service-password/advisory/CVE-2021-40539.html","title":"ManageEngine advisory CVE-2021-40539","kind":"advisory","source":"analyst","text":"ManageEngine advisory CVE-2021-40539: affected ADSelfService Plus builds up to 6113; fix build 6114 (Sep 7, 2021). Check: exploit detection tool RCEScan.bat; access_log entries containing /../RestAPI or /./RestAPI in \\ManageEngine\\ADSelfService Plus\\logs; serverOut and adslog (NullPointerException in addSmartCardConfig/getSmartCardConfig); files service.cer in bin, ReportGenerate.jsp, adap.jsp, custom.bat/custom.txt in C:\\Users\\Public, selfsdp.jspx, error.jsp, tomcat-ant.jar.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}