CVE-2025-11250
CriticalSummary
Authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6519 due to improper filter configurations.
Risk Assessment
An unauthorized user can gain access to the system without valid credentials, potentially leading to data security breaches.
Recommendation
Update ADSelfService Plus to version 6519 or later, which includes the fix.
Other vulnerabilities in ManageEngine ADSelfService Plus
See all- CVE-2026-74849Critical
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
- CVE-2026-75791High
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass in the REST API. The flaw allows unauthorized access to protected API functionality.
- CVE-2026-3183High
A vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6524 allows Multi Factor Authentication (MFA) bypass. An attacker can exploit this flaw to gain unauthorized access to the system without completing additional authentication factors.
Original NVD description (English source)
Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS