Zoho ManageEngine ADSelfService Plus - Authentication Bypass (CVE-2021-40539)
Description
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
psychologyCrowdSec Analysis
CVE-2021-40539 is a critical vulnerability in Zoho ManageEngine ADSelfService Plus, enabling remote code execution by bypassing REST API authentication mechanisms.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-40539 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-40539. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Exploitation efforts typically focus on endpoints containing /restapi/logoncustomization, /restapi/connection, or /help/admin-guide/test.jsp.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-09-07 |
| CISA KEV | 2021-11-03 |
| CISA Remediation Deadline | 2021-11-17 |
| Rule Released | 2025-04-07 |
| CrowdSec First Seen | 2025-04-07 |