Vulnerability record · CVE-2021-28958 · published 25 June 2021
CVE-2021-28958: Zoho ManageEngine ADSelfService Plus unauthenticated OS command injection in password change
Zohocorp · Manageengine Adselfservice Plus
Zoho ManageEngine ADSelfService Plus through build 6101 contains an OS command injection flaw (CWE-78) reachable during the password change flow. Because it is unauthenticated and network-reachable, it allows remote code execution without credentials, making it a severe risk for any internet-exposed deployment.
Description
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score and very high EPSS probability warrants immediate remediation.
What it is
Zoho ManageEngine ADSelfService Plus through build 6101 contains an OS command injection flaw (CWE-78) reachable during the password change flow. Because it is unauthenticated and network-reachable, it allows remote code execution without credentials, making it a severe risk for any internet-exposed deployment.
Impact
An unauthenticated attacker can execute arbitrary operating system commands on the server, leading to full compromise of the host and any credentials or directory data it handles.
Attack surface
Reached over the network via the password change functionality; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.73126, 99.43rd percentile), indicating strong likelihood of exploitation activity; references are vendor and third-party advisories only.
What to do
- Upgrade ADSelfService Plus to build 6102 or later, which the vendor released with the fix for this issue.
- If immediate patching is not possible, restrict network access to the ADSelfService Plus web interface to trusted networks or VPN.
- Remove direct internet exposure of the password change endpoint until the upgrade is applied.
- Review server and application logs for signs of command injection attempts around the password change flow.
- Rotate credentials and secrets stored or processed by the affected server if compromise is suspected.
Detection
- Monitor ADSelfService Plus web logs for anomalous requests to password change endpoints, especially with shell metacharacters or unexpected parameters.
- Alert on unexpected child processes spawned by the ADSelfService Plus service or its Java process.
- Watch for outbound connections from the ADSelfService Plus host to unfamiliar external addresses.
- Correlate file or command execution events on the host with password change activity in application logs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://blog.stmcyber.com/vulns/cve-2021-28958/ | Third Party Advisory |
| https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-f | Vendor Advisory |
| https://www.manageengine.com | Vendor Advisory |
| https://www.manageengine.com/products/self-service-password/release-notes.html#6102 | Release NotesVendor Advisory |
| https://blog.stmcyber.com/vulns/cve-2021-28958/ | Third Party Advisory |
| https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-f | Vendor Advisory |
| https://www.manageengine.com | Vendor Advisory |
| https://www.manageengine.com/products/self-service-password/release-notes.html#6102 | Release NotesVendor Advisory |
Track CVE-2021-28958 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-28958), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
