CVE-2026-3183
HighCVSS 7.1Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
A vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6524 allows Multi Factor Authentication (MFA) bypass. An attacker can exploit this flaw to gain unauthorized access to the system without completing additional authentication factors.
Risk Assessment
The risk involves potential account takeover and access to sensitive organizational data, leading to breaches of confidentiality and system integrity.
Recommendation
It is recommended to immediately upgrade Zohocorp ManageEngine ADSelfService Plus to version 6524 or later, which addresses this vulnerability.
Other vulnerabilities in ManageEngine ADSelfService Plus
See all- CVE-2026-74849Critical
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
- CVE-2025-11250Critical
Authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6519 due to improper filter configurations.
- CVE-2026-75791High
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass in the REST API. The flaw allows unauthorized access to protected API functionality.
Original NVD description (English source)
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS