CVE-2023-35854 json
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session…
published 2023-06-20 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-39847
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.0%
- EPSS 6.0% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
Patch / fix
- zohocorp manageengine_adselfservice_plus 6.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
5.98% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
manageengine.com
product
-
github.com
/970198175/Simply-use
third-party-advisory
Sources
- CVE List CVE-2023-35854
- NVD CVE-2023-35854
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.