Actively exploited · Published Sep 7, 2021 · Assigned by mitre

CVE-2021-40539

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity security flaw in ManageEngine from Zoho. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)99.0%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-706 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.manageengine.com x_refsource_MISC
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html x_refsource_MISC
http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539 government-resource