Zoho ManageEngine ADSelfService Plus - Information Disclosure (CVE-2022-28987)

CVE-2022-28987 is an information disclosure vulnerability in Zoho ManageEngine ADSelfService Plus prior to version 6202, allowing attackers to enumerate valid usernames by sending crafted POST requests to the login endpoint. This flaw could be exploited as part of a broader attack, such as credential stuffing or brute-force attempts, by providing attackers with a list of valid user accounts.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-28987 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2022-28987 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the /ServletAPI/accounts/login endpoint by submitting different usernames to the loginName parameter and analyzing the response messages to enumerate valid accounts. This technique leverages distinct server responses for existing versus non-existing usernames.