CVE-2021-28958

—

CVSS 3.1

9.8 critical

EPSS

73%p99

Published

Jun 25, 2021 (Jun 25, 2021)

Modified

Jun 17, 2026

Description

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

Vendors: zohocorp
Products: manageengine adselfservice plus
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (73.1%)

In the news1 stories

CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability

The Hacker NewsSep 17, 04:49 UTC · Sep 17, 2021Vulnerability in the wildCVE-2021-40539 CVE-2021-37421 CVE-2021-37417+3 CVEs

60