CVE-2021-40539

Timeline

Detection, updates, and resolution for this record.

1. Sep 7, 2021 · Catalog

   Detected

   Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

Affected

• cpe zohocorp/manageengine adselfservice plusversion unspecified
• cpe zohocorp/manageengine adselfservice plus6.1
• vendor Zoho ManageEngineversion unspecified

Sources

• CISA KEVCVE-2021-40539

  Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

  cisa.gov
• CVE.orgCVE-2021-40539

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-40539

  30-day exploitation probability 99.0%

  first.org
• Metasploit Modulesexploit_windows/http/manageengine_adselfservice_plus_cve_2021_40539

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2021-40539

  Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Product · manageengine.com
• Patch · manageengine.com