---
id: "CVE-2021-40539"
kind: "vulnerability"
aliases: ["CVE-2021-40539"]
title: "Zoho ManageEngine: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.9896
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Zoho ManageEngine", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ADSelfService Plus", "fixed": ["build 6114"], "affected": "<= build 6113", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adselfservice-plus", "exploited", "manageengine", "ransomware", "self-hosted", "vendor", "windows"]
not_affected_if: ["not-running-adselfservice-plus"]
published_at: "2021-09-07T17:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:30:48+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40539", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-40539", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40539", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:30:48+00:00"}]
---

# Zoho ManageEngine: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Zoho ManageEngine ADSelfService Plus has an authentication bypass in its REST API URLs that lets an unauthenticated attacker reach features that allow remote code execution. Attackers are exploiting it in the wild and it has been used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zoho ManageEngine affected ? fixed ?
- vendor:ADSelfService Plus affected <= build 6113 fixed build 6114

## How to check

Run vendor RCEScan.bat from ADSelfService Plus\bin as admin. Search \ManageEngine\ADSelfService Plus\logs access_log files for '/../RestAPI' or '/./RestAPI'; check serverOut and adslog for NullPointerException in addSmartCardConfig/getSmartCardConfig. Look for bin\service.cer, ReportGenerate.jsp, webapps\adssp\help\html\promotion\adap.jsp and selfsdp.jspx, html\error.jsp, lib\tomcat-ant.jar, C:\Users\Public\custom.bat/custom.txt.

## Fix

Update to ADSelfService Plus build 6114 or later via service pack. If compromised: disconnect, rebuild machine from backup on a clean host, then update and reset potentially exposed AD account passwords.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40539
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-40539
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-40539
- 2026-10-23T20:30:48+00:00 analyst — Read vendor advisory: affected builds <=6113, fixed in build 6114 (Sep 7 2021); detection via log strings and file IoCs. Exploitation per CISA KEV (from triage); public PoC link not checked.

## Documents

- [advisory] ManageEngine advisory CVE-2021-40539 https://www.manageengine.com/products/self-service-password/advisory/CVE-2021-40539.html

## From the sources

Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_