CVE-2026-75791: 
Zoho ManageEngine ADSelfService Plus vulnerability analysis and mitigation

CVE-2026-75791 is an authentication bypass vulnerability in the REST API of Zohocorp ManageEngine ADSelfService Plus, affecting all builds prior to build 7001. The flaw allows unauthenticated remote attackers to access REST API operations that are normally restricted to administrators. It was disclosed on September 22, 2026, and fixed on August 24, 2026 (build 7001). The vulnerability carries a CVSS v3.1 base score of 8.6 (High) (ManageEngine Advisory, GitHub Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function): under certain conditions, a specially crafted HTTP request can reach REST API endpoints without the authorization checks that the product normally enforces, bypassing authentication controls entirely. The attack vector is network-based, requires no privileges, no user interaction, and low attack complexity, making it automatable at scale. The vulnerability was reported by Ta Duc Thien through the Zoho BugBounty program, and the fix in build 7001 enforces consistent authorization checks across the REST API (ManageEngine Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to read sensitive product and Active Directory configuration information, modify administrator-restricted configuration settings, and potentially disrupt legitimate user access to the product (availability impact rated High). Because ADSelfService Plus manages password resets, account unlocks, and MFA for Active Directory environments, unauthorized configuration changes could facilitate broader identity-based attacks or service disruption across the organization (ManageEngine Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 1.715% (77th percentile), indicating a moderate probability of exploitation within 30 days relative to other CVEs. NVD's SSVC assessment classifies the vulnerability as automatable with partial technical impact and no known exploitation at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-facing ManageEngine ADSelfService Plus instances running builds prior to 7001 using tools like Shodan or Censys, searching for the product's default web interface or known service banners.
2. Identify REST API endpoints: Review publicly available ADSelfService Plus documentation or prior research to enumerate REST API endpoints that are normally restricted to administrators.
3. Craft bypass request: Construct a specially crafted HTTP request targeting a restricted REST API endpoint in a manner that bypasses the product's authorization checks (e.g., manipulating request headers, parameters, or endpoint paths to trigger the missing authentication condition).
4. Access restricted operations: Submit the crafted request without any authentication credentials; if successful, the server responds with data or accepts configuration changes as if the request were authorized.
5. Exfiltrate or modify data: Use the unauthenticated API access to read Active Directory and product configuration information, or modify administrator-restricted settings to disrupt service availability or facilitate further attacks (ManageEngine Advisory).

• Network: Unexpected or anomalous HTTP requests to ADSelfService Plus REST API endpoints (e.g., /api/...) originating from unauthenticated or unknown source IPs; high volume of REST API requests without corresponding authenticated sessions.
• Logs: ADSelfService Plus application logs showing REST API access without valid authentication tokens or session identifiers; repeated 200 OK responses to API calls that should require admin credentials.
• Logs: Access log entries showing requests to administrator-restricted REST API paths from external or unexpected IP addresses, particularly without prior login activity.
• Configuration: Unexpected changes to product or Active Directory configuration settings not attributable to known administrator activity.

Zohocorp has resolved this vulnerability in ADSelfService Plus build 7001, released August 24, 2026, by enforcing consistent authorization checks across the REST API. Organizations should update to build 7001 or later immediately using the service pack update process. As interim mitigations, implement network-level access controls (firewall rules, VPN requirements) to restrict REST API exposure to trusted networks only, and monitor for unauthorized REST API access attempts in application logs (ManageEngine Advisory, GitHub Advisory).

The vulnerability was reported through Zoho's BugBounty program by researcher Ta Duc Thien, and Zoho credited the researcher in their official advisory (ManageEngine Advisory). Community aggregators including VulDB, Vulners, and CVEFeed indexed the vulnerability shortly after disclosure, and it was noted on Bluesky and Mastodon by CVE tracking accounts. Qualys added detection for this vulnerability in their September 2026 application security detections release. No major independent security researcher write-ups or significant media coverage have been identified at this time.