CVE-2026-75791 in ManageEngine ADSelfService Plus
Summary
by MITRE • 09/22/2026
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw resides within the Representational State Transfer Application Programming Interface of Zoho Corporation's ManageEngine ADSelfService Plus software, specifically affecting builds prior to version 7001. This component serves as a critical interface for automated interactions and administrative tasks, allowing external systems or users to query user attributes, manage passwords, and perform other identity-related operations without necessarily navigating the graphical web interface. The vulnerability stems from an insufficient validation mechanism within the API endpoint logic, which fails to strictly enforce authentication requirements under specific conditions. This architectural oversight allows attackers to bypass standard credential verification processes, effectively granting unauthorized access to sensitive directory services data or administrative functions that should be restricted to authenticated and authorized personnel only.
From a technical perspective, this flaw is classified as an Authentication Bypass vulnerability, aligning with Common Weakness Enumeration identifier CWE-287. The root cause typically involves improper handling of authentication tokens or headers where the system incorrectly assumes trust based on request structure rather than verifying valid session state or credentials for every distinct API call. In many such implementations, developers may inadvertently expose internal endpoints that are not meant for public access or fail to apply consistent security filters across all entry points. An attacker can exploit this by crafting specific HTTP requests that omit required authentication parameters or manipulate existing ones in a way that the server accepts as valid due to logic errors in the validation routine. This bypass does not require complex exploitation techniques but relies on understanding the API's expected request format and exploiting the gap between intended security policy and actual implementation behavior.
The operational impact of this vulnerability is severe, particularly for organizations relying on ADSelfService Plus for centralized identity management within Active Directory environments. Successful exploitation allows an unauthenticated actor to access sensitive user information such as email addresses, phone numbers, departmental details, and potentially password reset capabilities. In a worst-case scenario, if the API exposes administrative functions or lacks proper authorization checks post-authentication bypass, it could lead to complete compromise of identity management controls. This enables attackers to perform privilege escalation, create backdoor accounts, or disrupt service availability by manipulating user statuses. The exposure of personally identifiable information also poses significant compliance risks under regulations such as GDPR and HIPAA, potentially resulting in legal penalties and reputational damage for the affected organization.
To mitigate this risk, organizations must immediately upgrade ManageEngine ADSelfService Plus to build 7001 or any later version where these authentication checks have been corrected by Zoho Corporation. It is imperative to verify that all systems running older builds are patched as soon as possible, given the public nature of such vulnerabilities which often lead to automated scanning and exploitation attempts in the wild. Additionally, administrators should implement network-level controls such as firewall rules or Web Application Firewalls to restrict access to the REST API endpoints only from trusted IP addresses known for legitimate integration purposes. Regular security audits and penetration testing focused on API authentication flows can help identify similar weaknesses before they are exploited. Monitoring logs for unusual patterns of unauthenticated requests targeting API endpoints is also recommended to detect potential exploitation attempts in real-time, ensuring rapid response capabilities if the vulnerability were ever targeted by malicious actors prior to patching.