Disclaimer: This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable
Mentions the CVE; no further detail.
CVE-2021-40539 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.0%
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho · ManageEngine
Summary
Zoho ManageEngine ADSelfService Plus, version 6113 and prior, contains an authentication bypass in its REST API that can lead to remote code execution. An unauthenticated attacker with network access to the REST API can exploit it without any user interaction or special configuration.
Official description · NVD
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
83.7 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 1
- Tactics
- 8/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
- Windows Management InstrumentationT1047 · Windows Management Instrumentation
- Create a new account to keep accessT1136 · Create Account
- Hide malicious codeT1027 · Obfuscated Files or Information
- Delete files to cover tracksT1070.004 · File Deletion
- Deobfuscate/Decode Files or InformationT1140 · Deobfuscate/Decode Files or Information
- System Binary Proxy ExecutionT1218 · System Binary Proxy Execution
- Dump stored passwords and hashesT1003 · OS Credential Dumping
- Copy the Active Directory databaseT1003.003 · NTDS
- List domain accountsT1087.002 · Domain Account
- Archive via UtilityT1560.001 · Archive via Utility
- Symmetric CryptographyT1573.001 · Symmetric Cryptography
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 9 days after disclosure. Public exploit code (Metasploit) was available the same day.
- First seen exploitedVulnCheck KEV evidence+9 days
- Added to CISA KEVknown ransomware use; EU database agrees+57 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
13 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 1 cited passage 13Initial AccessTA0001
MITRE CTID mapping of the KEV entry · how it is exploited
This is an authentication bypass vulnerability that can enable remote code execution. Numerous post-exploitation impacts by threat actors are detailed in the referenced CISA report.
Exploiting vulnerabilities [T1190] in widely used software including, but not limited to: CVE-2021-40539—ManageEngine ADSelfService Plus.
ExecutionTA0002
MITRE CTID mapping of the KEV entry · follow-on activity
PersistenceTA0003
Create Account T1136
MITRE CTID mapping of the KEV entry · follow-on activity
Web Shell T1505.003
MITRE CTID mapping of the KEV entry · primary impact
CVE-2021-40539 is an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution. Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.
Stealth
MITRE CTID mapping of the KEV entry · follow-on activity
File Deletion T1070.004
MITRE CTID mapping of the KEV entry · follow-on activity
MITRE CTID mapping of the KEV entry · follow-on activity
MITRE CTID mapping of the KEV entry · follow-on activity
Credential AccessTA0006
OS Credential Dumping T1003
MITRE CTID mapping of the KEV entry · follow-on activity
NTDS T1003.003
MITRE CTID mapping of the KEV entry · follow-on activity
DiscoveryTA0007
Domain Account T1087.002
MITRE CTID mapping of the KEV entry · follow-on activity
CollectionTA0009
Archive via Utility T1560.001
MITRE CTID mapping of the KEV entry · follow-on activity
Command and ControlTA0011
Symmetric Cryptography T1573.001
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
2 rules for this CVE · 624 general rules for its techniquesRules for this CVE
2Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-40539 directly.General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Windows Management InstrumentationT104752 general rules
- Potential Maze Ransomware Activitycriticaltest
- UNC2452 PowerShell Patterncriticaltest
- Wmiexec Default Output Filecriticaltest
- Wmiprvse Wbemcomn DLL Hijack - Filecriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- HackTool - Potential Impacket Lateral Movement Activityhighstable
- Blue Mockingbirdhightest
- Blue Mockingbird - Registryhightest
Create AccountT11363 general rules
Obfuscated Files or InformationT102795 general rules
- Turla Group Commands May 2020criticaltest
- Potential Emotet Activityhighstable
- Base64 Encoded PowerShell Command Detectedhightest
- File Decoded From Base64/Hex Via Certutil.EXEhightest
- File In Suspicious Location Encoded To Base64 Via Certutil.EXEhightest
- Invoke-Obfuscation CLIP+ Launcherhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShellhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Modulehightest
File DeletionT1070.00415 general rules
- Prefetch File Deletedhightest
- Suspicious Ping/Del Command Combinationhightest
- ADS Zone.Identifier Deleted By Uncommon Applicationmediumtest
- Backup Catalog Deletedmediumtest
- Cisco File Deletionmediumtest
- File Deleted Via Sysinternals SDeletemediumtest
- Greedy File Deletion Using Delmediumtest
- Potential Secure Deletion with SDeletemediumtest
Deobfuscate/Decode Files or InformationT114018 general rules
- Base64 Encoded PowerShell Command Detectedhightest
- MSHTA Execution with Suspicious File Extensionshightest
- Ping Hex IPhightest
- Potential Base64 Decoded From Imageshightest
- Potential BlackByte Ransomware Activityhightest
- PowerShell Base64 Encoded FromBase64String Cmdlethightest
- Suspicious Inbox Manipulation Ruleshightest
- UNC4841 - Download Compressed Files From Temp.sh Using Wgethightest
System Binary Proxy ExecutionT1218158 general rules
- Arbitrary File Download Via IMEWDBLD.EXEhightest
- Curl Download And Execute Combinationhightest
- Devtoolslauncher.exe Executes Specified Binaryhightest
- Execute Pcwrun.EXE To Leverage Follinahightest
- Execution DLL of Choice Using WAB.EXEhightest
- Execution via stordiag.exehightest
- Execution via WorkFolders.exehightest
- File Download Via Windows Defender MpCmpRun.EXEhightest
OS Credential DumpingT100337 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Rubeus Executioncriticalstable
- Hacktool Execution - Imphashcriticaltest
- Potential Credential Dumping Via LSASS Process Clonecriticaltest
- WCE wceaux.dll Accesscriticaltest
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdumphightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Hacktool Execution - PE Metadatahightest
NTDST1003.00324 general rules
- Potential Russian APT Credential Theft Activitycriticalstable
- VolumeShadowCopy Symlink Creation Via Mklinkhighstable
- Copying Sensitive Files with Credential Datahightest
- Create Volume Shadow Copy with Powershellhightest
- Cred Dump Tools Dropped Fileshightest
- NTDS Exfiltration Filename Patternshightest
- NTDS.DIT Creation By Uncommon Parent Processhightest
- NTDS.DIT Creation By Uncommon Processhightest
Domain AccountT1087.00221 general rules
- AD Privileged Users or Groups Reconnaissancehightest
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- PUA - AdFind Suspicious Executionhightest
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest
Archive via UtilityT1560.00117 general rules
- APT31 Judgement Panda Activitycriticaltest
- Rar Usage with Password and Compression Levelhightest
- Suspicious Manipulation Of Default Accounts Via Net.EXEhightest
- LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental
- 7Zip Compressing Dump Filesmediumtest
- Compress Data and Lock With Password for Exfiltration With 7-ZIPmediumtest
- Compress Data and Lock With Password for Exfiltration With WINZIPmediumtest
- Disk Image Mounting Via Hdiutil - MacOSmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportmedia.defense.gov
Reports are matched by finding the exact id CVE-2021-40539 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX