CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

• CWE-706
• CWE-706

• http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.manageengine.comProduct
• https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.htmlPatch, Vendor Advisory
• http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.manageengine.comProduct
• https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.htmlPatch, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539US Government Resource

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40529The ElGamal implementation in Botan through 2.18.1, as used …5.9
• CVE-2021-4053Use after free in UI in Google Chrome on Linux prior to 96.0…8.8
• CVE-2021-40530The ElGamal implementation in Crypto++ through 8.5 allows pl…5.9
• CVE-2021-40531Sketch before 75 allows library feeds to be used to bypass f…9.8
• CVE-2021-40532Telegram Web K Alpha before 0.7.2 mishandles the characters …9.8
• CVE-2021-40537Server Side Request Forgery (SSRF) vulnerability exists in o…2.7
• CVE-2021-4054Incorrect security UI in autofill in Google Chrome prior to …6.5
• CVE-2021-40540ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omit…9.8
• CVE-2021-40541PHPFusion 9.03.110 is affected by cross-site scripting (XSS)…6.1
• CVE-2021-40542Opensis-Classic Version 8.0 is affected by cross-site script…6.1
• CVE-2021-40543Opensis-Classic Version 8.0 is affected by a SQL injection v…9.8
• CVE-2021-40546Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers…4.9