{"id":"CVE-2021-40539","published":"2021-09-07T17:15:07Z","modified":"2026-06-17T04:07:06Z","title":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","vendor":"Zoho","product":"ManageEngine","tier":"core","eol":null,"description":{"text":"Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"Zoho ManageEngine ADSelfService Plus, version 6113 and prior, contains an authentication bypass in its REST API that can lead to remote code execution. An unauthenticated attacker with network access to the REST API can exploit it without any user interaction or special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:00Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9896,"percentile":0.99929,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40539","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-09-16","exploitedFirstSeen":"2021-09-16","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2021/09/16/fbi-cisa-cgcyber-advisory-apt-exploitation-manageengine-adselfservice","date":"2021-09-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/","date":"2021-11-07"},{"url":"https://www.microsoft.com/en-us/security/blog/2021/11/08/threat-actor-dev-0322-exploiting-zoho-manageengine-adselfservice-plus/","date":"2021-11-08"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-259a","date":"2021-11-22"},{"url":"https://cisa.gov/news-events/alerts/2021/11/19/updated-apt-exploitation-manageengine-adselfservice-plus","date":"2021-11-24"},{"url":"https://verfassungsschutz.thueringen.de/fileadmin/Verfassungsschutz/Spionage/BfV_Cyber-Brief_Nr__2022_01_pdf.pdf","date":"2022-01-30"},{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2022GTR.pdf","date":"2022-02-15"},{"url":"https://unit42.paloaltonetworks.com/sockdetour/","date":"2022-02-24"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"}],"evidenceTotal":793,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference"},{"id":"CWE-55","name":"Path Equivalence: '/./' (Single Dot Directory)"}],"references":[{"url":"http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.manageengine.com","tags":["Product"]},{"url":"https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.manageengine.com","tags":["Product"]},{"url":"https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-attack-id"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass; ATT&CK ID T1190 introduces a list containing CVE-2021-40539","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-85c8e0502ba6942d5745","quote":" Exploiting vulnerabilities [T1190] in widely used software including, but not limited\r\nto:\r\n CVE-2021-40539—ManageEngine ADSelfService Plus.","start":30514,"end":30657}],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-40539 is an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution. Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.\n\n","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1070.004","name":"File Deletion","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1560.001","name":"Archive via Utility","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"},{"id":"T1573.001","name":"Symmetric Cryptography","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.","confidence":"high"}],"reports":[{"id":"SRC-85c8e0502ba6942d5745","title":"Disclaimer: This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable","publisher":"media.defense.gov","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF","date":null,"mentions":[{"quote":" CVE-2021-40539—ManageEngine ADSelfService Plus.","start":30608,"end":30657}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-27714","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-27714","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2021-09-17","earliestUrl":"https://github.com/DarkSprings/CVE-2021-40539","repos":[{"name":"synacktiv/CVE-2021-40539","url":"https://github.com/synacktiv/CVE-2021-40539","stars":48,"created":"2021-11-03"},{"name":"DarkSprings/CVE-2021-40539","url":"https://github.com/DarkSprings/CVE-2021-40539","stars":2,"created":"2021-09-17"},{"name":"Bu0uCat/ADSelfService-Plus-RCE-CVE-2021-40539","url":"https://github.com/Bu0uCat/ADSelfService-Plus-RCE-CVE-2021-40539","stars":2,"created":"2024-10-16"},{"name":"lpyydxs/CVE-2021-40539","url":"https://github.com/lpyydxs/CVE-2021-40539","stars":1,"created":"2024-10-12"},{"name":"lpyzds/CVE-2021-40539","url":"https://github.com/lpyzds/CVE-2021-40539","stars":0,"created":"2024-10-12"}]},"metasploit":[{"name":"ManageEngine ADSelfService Plus CVE-2021-40539","module":"exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539","type":"exploit","disclosureDate":"2021-09-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.rb"}],"nuclei":[{"id":"CVE-2021-40539","name":"Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution","severity":"critical","path":"http/cves/2021/CVE-2021-40539.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40539.yaml"}],"first":{"date":"2021-09-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit","id":"fcbb4a77-f368-4945-b046-4499a1da69d1","level":"critical","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml","techniques":["T1190","T1505.003"]},{"title":"ADSelfService Exploitation","id":"6702b13c-e421-44cc-ab33-42cc25570f11","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1505.003"],"provenance":"source"},{"stage":"secondary","techniques":["T1047","T1136","T1027","T1070.004","T1140","T1218","T1003","T1003.003","T1087.002","T1560.001","T1573.001"],"provenance":"source"}],"timeline":[{"date":"2021-09-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40539","provenance":"source"},{"date":"2021-09-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-09-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.rb","provenance":"source"},{"date":"2021-09-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2021/09/16/fbi-cisa-cgcyber-advisory-apt-exploitation-manageengine-adselfservice","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-27714","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":57},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1869 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}