CVE-2025-11670 Overview
CVE-2025-11670 is an NTLM hash exposure vulnerability in Zohocorp ManageEngine ADManager Plus versions before build 8025. The flaw allows a technician account with the Impersonate as Admin option enabled to obtain NTLM authentication hashes that should remain protected. Attackers with this privilege can capture credential material usable for offline cracking or NTLM relay attacks against Active Directory infrastructure. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
A privileged technician with impersonation rights can extract NTLM hashes from ADManager Plus, enabling downstream Active Directory credential attacks.
Affected Products
- Zohocorp ManageEngine ADManager Plus builds 8000, 8001, 8002
- Zohocorp ManageEngine ADManager Plus builds 8010, 8011, 8012
- Zohocorp ManageEngine ADManager Plus builds 8020, 8021, 8022
Discovery Timeline
- 2025-12-15 - CVE-2025-11670 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11670
Vulnerability Analysis
Zohocorp ManageEngine ADManager Plus is a web-based Active Directory management tool that supports delegated administration through technician accounts. The application exposes NTLM hash material through functionality accessible to technicians who possess the Impersonate as Admin permission. Because impersonation rights are typically granted to trusted operational roles, the vulnerability sits inside an authenticated attack surface rather than a preauthentication path.
An attacker who compromises or abuses such a technician account can retrieve NTLM hashes tied to accounts within the managed domain. Recovered hashes support offline password cracking, pass-the-hash movement, and NTLM relay to services that accept NTLM authentication. The vulnerability affects confidentiality without directly modifying integrity or availability of the ADManager Plus service.
Root Cause
The root cause is improper protection of sensitive authentication material inside a code path that runs under impersonation. Zohocorp's advisory attributes the issue to the impersonation flow returning NTLM hash content instead of restricting the response to non-sensitive attributes. See the ManageEngine Security Advisory CVE-2025-11670 for vendor-provided detail.
Attack Vector
Exploitation requires network access to the ADManager Plus console and a valid technician account with the Impersonate as Admin option enabled. The attacker interacts with the affected functionality under an impersonated administrator context and reads the returned NTLM hash values from the response. No user interaction is required beyond the attacker's own session activity.
No public proof-of-concept exploit code has been published for CVE-2025-11670, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the vendor advisory for authoritative technical detail.
Detection Methods for CVE-2025-11670
Indicators of Compromise
- ADManager Plus audit log entries showing technician accounts invoking impersonation against high-privilege administrator accounts.
- Unexpected spikes in requests to ADManager Plus endpoints that return user attribute data while under impersonation context.
- Subsequent NTLM authentication attempts from unusual sources against Active Directory using hashes tied to accounts managed by ADManager Plus.
Detection Strategies
- Review the ADManager Plus Admin Audit and Technician Audit reports for uses of Impersonate as Admin, focusing on technicians without a documented operational need.
- Correlate ADManager Plus authentication events with Windows Security Event ID 4624 and 4776 on domain controllers to identify off-hours or anomalous NTLM activity.
- Alert on ADManager Plus installations still reporting a build number below 8025 in software inventory sources.
Monitoring Recommendations
- Forward ADManager Plus application, audit, and access logs to a centralized SIEM or data lake with retention aligned to Active Directory audit policy.
- Baseline normal impersonation frequency per technician and alert on deviations exceeding that baseline.
- Monitor the ADManager Plus server host for outbound NTLM traffic to systems outside its normal management scope.
How to Mitigate CVE-2025-11670
Immediate Actions Required
- Upgrade Zohocorp ManageEngine ADManager Plus to build 8025 or later on all instances, including disaster-recovery replicas.
- Audit the list of technicians with the Impersonate as Admin option enabled and remove the right from any account that does not require it.
- Rotate credentials for any privileged Active Directory accounts that could have been impersonated on unpatched builds.
Patch Information
Zohocorp addressed CVE-2025-11670 in ADManager Plus build 8025. Administrators should apply the vendor-supplied service pack from the ManageEngine Security Advisory CVE-2025-11670 and validate the installed build number after the upgrade completes.
Workarounds
- Disable the Impersonate as Admin option for all technician roles until the patch is applied.
- Restrict network access to the ADManager Plus web console to a limited administrative network segment.
- Enforce multi-factor authentication on technician accounts to raise the cost of account compromise that would enable this vulnerability.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
