CVE-2026-75791: ManageEngine ADSelfService Plus Auth Bypass

CVE-2026-75791 Overview

CVE-2026-75791 is an authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus. The flaw affects all builds prior to 7001 and resides in the product's REST API. An unauthenticated remote attacker can reach protected API endpoints without providing valid credentials, exploiting missing authentication controls categorized under [CWE-306].

ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory. It is typically exposed to internal networks and, in many deployments, published externally to support remote password resets. This exposure widens the attack surface for the flaw.

Critical Impact

An unauthenticated network attacker can invoke REST API functionality intended to require authentication, potentially impacting confidentiality, integrity, and availability of identity self-service operations.

Affected Products

• Zohocorp ManageEngine ADSelfService Plus builds prior to 7001
• Deployments exposing the REST API to internal networks
• Internet-facing ADSelfService Plus portals used for remote password resets

Discovery Timeline

• 2026-09-22 - CVE-2026-75791 published to the National Vulnerability Database
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75791

Vulnerability Analysis

The vulnerability is an authentication bypass in the REST API of ManageEngine ADSelfService Plus. Attackers can reach API functionality across the network without valid credentials and without user interaction. Successful exploitation impacts confidentiality and integrity at a limited level, while availability can be severely affected.

ADSelfService Plus manages sensitive identity workflows including password resets, account unlocks, and multi-factor enrollment. API endpoints that expose these workflows without proper authentication enforcement allow attackers to invoke privileged operations against Active Directory-linked accounts.

The issue is tracked under CWE-306: Missing Authentication for Critical Function. This weakness class describes software that performs a security-relevant action without first verifying the identity of the requester.

Root Cause

The root cause is missing or incomplete authentication enforcement on one or more REST API routes. Requests that should be validated against an authenticated session are processed by the application server without that check. The vendor addressed the flaw in build 7001 by adding the missing enforcement.

Attack Vector

Exploitation requires network access to the ADSelfService Plus REST API endpoint and no authentication. An attacker crafts an HTTP request to a vulnerable API route and receives a response as if authenticated. Full technical specifics were not published by the vendor. See the ManageEngine Security Advisory for CVE-2026-75791 for authoritative details.

Detection Methods for CVE-2026-75791

Indicators of Compromise

• Unexpected HTTP requests to ADSelfService Plus REST API paths from external or unusual internal source addresses
• Successful API responses (HTTP 200) to requests that lack a valid session cookie or authorization header
• Unexplained password reset, account unlock, or MFA enrollment events in ADSelfService Plus audit logs
• Anomalous Active Directory account modifications originating from the ADSelfService Plus service account

Detection Strategies

• Inspect web server and application logs for REST API calls that bypass the login flow
• Correlate ADSelfService Plus audit events with authenticated session identifiers to identify orphaned actions
• Baseline normal API traffic patterns and alert on spikes or off-hours activity
• Monitor Active Directory change events for password resets not tied to a legitimate user-initiated session

Monitoring Recommendations

• Forward ADSelfService Plus access, audit, and application logs to a central SIEM for correlation
• Alert on any REST API request pattern that returns success without prior authentication events
• Track outbound connections from the ADSelfService Plus host to detect post-exploitation activity

How to Mitigate CVE-2026-75791

Immediate Actions Required

• Upgrade ManageEngine ADSelfService Plus to build 7001 or later without delay
• Inventory all ADSelfService Plus instances, including test and disaster recovery deployments
• Review ADSelfService Plus audit logs for evidence of unauthenticated API access prior to patching
• Rotate credentials for the ADSelfService Plus service account if compromise is suspected

Patch Information

Zohocorp fixed CVE-2026-75791 in ManageEngine ADSelfService Plus build 7001. Administrators should download the update through the ManageEngine service pack utility and apply it to every instance. Refer to the ManageEngine Security Advisory for CVE-2026-75791 for upgrade instructions and validation steps.

Workarounds

• Restrict network access to the ADSelfService Plus REST API using firewall rules or a reverse proxy allowlist
• Place internet-facing deployments behind a web application firewall with rules to block unauthenticated API access
• Disable or isolate the ADSelfService Plus instance until the patch can be applied if external exposure cannot be limited