Back to CVE Browser

CVE-2021-40539

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score42.9920%

EPSS Percentile96.93th

Published2021-09-07

Last Modified2025-11-05

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Affected Platforms (CPE)

📦

Zohocorp

Manageengine Adselfservice Plus

< 6.1= 6.1

References & Advisories

🔗 http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html

🔗 https://www.manageengine.com

🔗 https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html

🔗 http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html

🔗 https://www.manageengine.com

🔗 https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539

Related Vulnerabilities

CVE-2026-106843.0

In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header ...

CVE-2026-153444.9

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up t...

CVE-2026-555552.3

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the m...

CVE-2026-592488.7

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to...