VulnerabilitycriticalExploited in the wild

CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability

The Hacker Newsby @TheHackersNewsSep 17, 2021 · 04:49 UTC (Sep 17, 2021)2 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-40539 CVE-2021-37421 CVE-2021-37417 CVE-2021-33055 CVE-2021-28958 CVE-2020-10189

Tags: cve-2021-40539 cve-2021-37421 cve-2021-37417 cve-2021-33055 cve-2021-28958 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-10189	Unauthenticated RCE in Zoho ManageEngine Desktop Central	9.8	100%	KEVPoC ×3	Mar 6, 2020 KEV Nov 3, 2021
CVE-2021-28958	Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password	9.8	73%		Jun 25, 2021
CVE-2021-33055 +2 related CVEs CVE-2021-37417 CVE-2021-37421	Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions	9.8	18%		Aug 30, 2021
CVE-2021-40539	Unauthenticated RCE via REST API auth bypass in Zoho ManageEngine ADSelfService Plus	9.8	99%	KEVRansomwarePoC	Sep 7, 2021 KEV Nov 3, 2021

From the original article

2 min read at thehackernews.com

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday issued a bulletin warning of a zero-day flaw affecting Zoho ManageEngine ADSelfService Plus deployments that is currently being actively exploited in the wild.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.