# CVE-2022-28987: Zoho ManageEngine ADSelfService Plus - Information Disclosure

> Live exploitation tracking for CVE-2022-28987 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-28987

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Zoho ManageEngine ADSelfService Plus
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** enterprise_software, management_panel

## Description

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.

## CrowdSec analysis

[CVE-2022-28987](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-28987) is an information disclosure vulnerability in Zoho ManageEngine ADSelfService Plus prior to version 6202, allowing attackers to enumerate valid usernames by sending crafted POST requests to the login endpoint. This flaw could be exploited as part of a broader attack, such as credential stuffing or brute-force attempts, by providing attackers with a list of valid user accounts.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-28987 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2022-28987 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/ServletAPI/accounts/login` endpoint by submitting different usernames to the loginName parameter and analyzing the response messages to enumerate valid accounts. This technique leverages distinct server responses for existing versus non-existing usernames.

## Timeline

- 2022-05-20: CVE Published. CVE-2022-28987 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2022-28987 exploitation attempts against the CrowdSec Network.
- 2026-04-01: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-28987 for the first time.

## References

- https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.py
- https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28987.html
- https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28987.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-28987) follows observed exploitation activity for CVE-2022-28987. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.