CVE-2025-9435: 
Zoho ManageEngine ADManager Plus vulnerability analysis and mitigation

CVE-2025-9435 is an authenticated path traversal vulnerability in the User Management module of Zohocorp ManageEngine ADManager Plus. It affects all versions below build 7230 (specifically build 7224 and older, including all 7.2.x sub-builds). The vulnerability was reported via Zoho's Bug Bounty program by researcher metin kandemir and was published on January 13, 2026, with a patch released on March 6, 2024 (build 7230). It carries a CVSS v3.1 base score of 5.5 (Medium), assigned by ManageEngine (ManageEngine Advisory, NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and resides in the User Management module of ADManager Plus. An authenticated attacker with low-level privileges can manipulate file path inputs to traverse outside the intended directory boundaries on the server, enabling the creation of arbitrary folders and injection of files into those locations. Exploitation requires network access, low privileges, and user interaction, but has low attack complexity (ManageEngine Advisory, NVD). A public proof-of-concept exploit is available on GitHub (PoC GitHub).

Successful exploitation allows an authenticated attacker to create arbitrary folders on the ADManager Plus server instance and inject files into those directories, impacting confidentiality, integrity, and availability at a low level each. While the vulnerability does not directly enable full system compromise or remote code execution, unauthorized file creation and injection could facilitate further attacks such as planting malicious scripts or accessing sensitive configuration data. The scope is limited to the affected server instance without privilege escalation beyond the application context (ManageEngine Advisory, NVD).

A public proof-of-concept exploit has been published on GitHub by user 'passtheticket' as of March 2, 2026 (PoC GitHub). There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), indicating a low probability of exploitation in the near term (Feedly). No threat actor attribution has been reported.

1. Reconnaissance: Identify ManageEngine ADManager Plus instances running build 7224 or earlier using network scanning or web application fingerprinting tools.
2. Authentication: Log in to the ADManager Plus web interface using any valid low-privileged user account.
3. Navigate to User Management module: Access the vulnerable User Management functionality within the application.
4. Craft path traversal payload: Manipulate file path parameters (e.g., using ../ sequences or URL-encoded equivalents) in requests to the User Management module to reference directories outside the intended application directory.
5. Create arbitrary folders/inject files: Submit the crafted request to create folders at arbitrary locations on the server filesystem or inject files into those directories, potentially staging further payloads (ManageEngine Advisory, PoC GitHub).

• Network: Unusual HTTP requests to ADManager Plus User Management endpoints containing path traversal sequences such as ../, %2e%2e%2f, or %2e%2e/ in parameters.
• File System: Unexpected directories or files created outside the standard ADManager Plus installation directory tree; newly created folders in system or application directories not associated with normal operations.
• Logs: ADManager Plus application logs showing requests with anomalous file path parameters; server-side errors or exceptions related to file system operations in unexpected directories.
• Process: File creation events triggered by the ADManager Plus service account in directories outside the application's expected working paths.

ManageEngine has released a fix in ADManager Plus build 7230. All users running build 7224 or earlier should upgrade to build 7230 or later by installing the available service pack (ManageEngine Advisory). As interim mitigations, organizations should restrict access to the User Management module to only trusted administrators, apply the principle of least privilege to application user accounts, and monitor access logs for suspicious file traversal patterns. Network-level controls limiting access to the ADManager Plus interface to authorized IP ranges can further reduce exposure.