High CVSS 7.1
CVE-2026-3183
NVD analysis in progress
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read some data and modify or destroy data.
- Weakness
- Authentication relies on a spoofable value such as an IP address or header.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.