Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2021-40539

Quick assessment

Affected

n/a n/a

Exploitation

Confirmed exploitation in the wild; remediate immediately

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZOHO ManageEngine ADSelfService Plus是美国卓豪（ZOHO）公司的针对 Active Directory 和云应用程序的集成式自助密码管理和单点登录解决方案。 Zoho ManageEngine ADSelfService Plus 6113版本及更早版本存在授权问题漏洞，该漏洞源于软件很容易绕过REST API认证，从而导致远程代码执行。

AI Predicted 9.8 Difficulty: Trivial KEV · Ransomware EPSS 98.96% · P100 Updated Feb 25, 2026

Public Exploits 2

Metasploit · 1 manageengine_adselfservice_plus_cve_2021_40539.rb [exploit]

Nuclei · 1 CVE-2021-40539.yaml [template]

In-the-Wild Activity Observed cisa_kev · confirmed

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-40539

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

ZOHO ManageEngine ADSelfService Plus 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2021-40539

#	POC Description	Source Link	Shenlong Link
1	CVE-2021-40539 POC	https://github.com/DarkSprings/CVE-2021-40539	POC Details
2	Exploitation code for CVE-2021-40539	https://github.com/synacktiv/CVE-2021-40539	POC Details
3	CVE-2021-40539：ADSelfService Plus RCE漏洞	https://github.com/lpyzds/CVE-2021-40539	POC Details
4	CVE-2021-40539：ADSelfService Plus RCE漏洞	https://github.com/lpyydxs/CVE-2021-40539	POC Details
5	ADSelfService Plus RCE漏洞检测工具 (二开)	https://github.com/Bu0uCat/ADSelfService-Plus-RCE-CVE-2021-40539	POC Details
6	Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40539.yaml	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2021-40539

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2021-40539 (1)

http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html x_refsource_MISC

Other References for CVE-2021-40539 (2)

https://www.manageengine.com x_refsource_MISC
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2021-40539

Same Patch Batch · n/a · 2021-09-07 · 102 CVEs total

CVE-2021-38617	8.8 HIGH	Eigen NLP 安全漏洞
CVE-2021-38616	7.6 HIGH	Eigen NLP 安全漏洞
CVE-2021-38615	6.3 MEDIUM	Eigen NLP 安全漏洞
CVE-2021-38841		Simple Water Refilling Station Management System 代码问题漏洞
CVE-2021-38840		Simple Water Refilling Station Management System SQL注入漏洞
CVE-2021-39278		Moxa多款产品跨站脚本漏洞
CVE-2021-39279		Moxa 多款产品操作系统命令注入漏洞
CVE-2021-28136		Espressif ESP-IDF缓冲区错误漏洞
CVE-2021-34144		Zhuhai Jieli AC690X输入验证错误漏洞
CVE-2021-28135		Espressif ESP-IDF 安全漏洞
CVE-2021-28155		JBL TUNE500BT输入验证错误漏洞
CVE-2021-34150		Bluetrum AB5301A 缓冲区错误漏洞
CVE-2021-31613		Zhuhai Jieli AC690X输入验证错误漏洞
CVE-2021-31611		Zhuhai Jieli AC690X 输入验证错误漏洞
CVE-2021-31786		Actions ATS2815 输入验证错误漏洞
CVE-2021-28139		Espressif ESP-IDF 代码注入漏洞
CVE-2021-34148		Cypress WICED BT输入验证错误漏洞
CVE-2021-34147		Cypress WICED BT 输入验证错误漏洞
CVE-2021-34145		Cypress WICED BT 输入验证错误漏洞
CVE-2021-31609		Silicon Labs iWRAP 安全漏洞

Showing top 20 of 102 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a

V. Comments for CVE-2021-40539

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2021-40539

Quick assessment

Public Exploits 2

Possible ATT&CK Techniques 3 AI

I. Basic Information for CVE-2021-40539

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Shenlong Deep Dive — AI Deep Analysis

Affected Products

II. Public POCs for CVE-2021-40539

III. Intelligence Information for CVE-2021-40539

Exploits & Public PoCs for CVE-2021-40539 (1)

Other References for CVE-2021-40539 (2)

Same Patch Batch · n/a · 2021-09-07 · 102 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2021-40539

Leave a comment