CVE-2026-75791
HighCVSS 8.6Summary
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass in the REST API. The flaw allows unauthorized access to protected API functionality.
Risk Assessment
An attacker can bypass authentication and access the REST API, potentially leading to data disclosure or unauthorized operations. The risk is especially significant for systems exposed to the network.
Recommendation
Update ManageEngine ADSelfService Plus to build 7001 or later. Until then, restrict REST API access from untrusted networks.
Other vulnerabilities in ManageEngine ADSelfService Plus
See all- CVE-2026-74849Critical
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
- CVE-2025-11250Critical
Authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6519 due to improper filter configurations.
- CVE-2026-3183High
A vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6524 allows Multi Factor Authentication (MFA) bypass. An attacker can exploit this flaw to gain unauthorized access to the system without completing additional authentication factors.
Original NVD description (English source)
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.