ManageEngine ADManager Plus
CVE-2025-11670
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain technician account with Impersonate-as-Admin
-
DeliveryTrigger NTLM-authenticated operation
-
ExploitCapture exposed NTLM hash
-
ExecutionCrack or relay hash
-
ImpactEscalate privileges in Active Directory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated ADManager Plus technician account that has the non-default 'Impersonate as Admin' delegation option explicitly enabled - this is the exact feature gate named in the vendor advisory. Without a technician role holding that setting, the vulnerability is not reachable, which sharply limits the exploitable population to a small, already-trusted set of privileged operators. Affected deployments are ADManager Plus builds before 8025; upgrading to 8025 remediates. No end-user interaction is required beyond the technician triggering the relevant operation. |
| Impact | This is a low-to-moderate risk issue despite affecting enterprise software. The CVSS 3.1 base score of 4.3 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) correctly reflects a confidentiality-only disclosure with no integrity or availability impact. The decisive mitigating factor is PR:L combined with a very specific precondition: the description states exploitation is 'only by technicians who have the Impersonate as Admin option enabled,' meaning the attacker must already hold a privileged, trusted delegated role inside ADManager Plus. EPSS is low at 0.44% (36th percentile), consistent with no active-exploitation pressure. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' These signals align rather than conflict - a modest CVSS, low EPSS, no KEV, and a narrow privilege gate all point to a genuinely low-priority finding rather than a high-CVSS-but-overblown one. The residual concern is contextual: NTLM hash exposure in an Active Directory management product is a lateral-movement/privilege-escalation building block (crack offline or relay), so it is worth patching in AD-critical environments even though standalone risk is limited. |
| Exploit ScenarioDerived | A technician account in ADManager Plus that has the 'Impersonate as Admin' option enabled triggers a workflow that causes the server to disclose an NTLM hash. The attacker (an insider or someone who has compromised such a technician account) captures the hash and takes it offline to crack it or relays it against other AD services to escalate privileges. No public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
NTLM hash exposure in Zoho ManageEngine ADManager Plus builds prior to 8025 allows an authenticated technician account that has the non-default 'Impersonate as Admin' delegation option enabled to obtain NTLM credential material that the application should retain internally. The flaw is scoped as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (base 4.3), so exploitation requires a valid low-privileged technician login plus that specific feature gate, sharply limiting the reachable attacker population to already-trusted privileged operators; confidentiality impact is limited and there is no integrity or availability effect. No public exploit code has been identified at time of analysis, and EPSS is low at 0.44% (36th percentile), making this a low-to-moderate risk issue rather than an urgent, actively exploited threat.
RemediationAI
Upgrade ADManager Plus to build 8025 or later (vendor-released patch: 8025), which remediates the NTLM hash exposure; the vendor advisory at https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html documents the fix. If upgrade cannot be scheduled immediately, the most effective compensating control is to audit and remove the 'Impersonate as Admin' option from all technician roles (or disable the underlying delegation setting entirely), since the vulnerability is unreachable without it - the trade-off is that technicians lose delegated admin capabilities and those workflows must be performed by a full administrator or through a separate privileged path. Additionally, restrict network access to the ADManager Plus web console to a management VLAN or jump host and block it from general user subnets, which reduces the population that can reach the endpoint at all but complicates remote administration for legitimate operators. Because NTLM credential material may already have been read by a technician holding the option, treat the fix as incomplete without containment: rotate passwords for AD accounts whose hashes could have transited the vulnerable path, and monitor domain controllers for NTLM relay or anomalous authentication from the ADManager Plus host. There is no indication of active exploitation, so emergency out-of-band response is not required, but the upgrade should be tracked as a routine patch item on an enterprise-facing AD management system.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-200 exposure of sensitive information affecting ManageEngine ADManager Plus, a Windows-oriented Active Directory administration, reporting and delegation console. ADManager Plus authenticates its operators against AD and, for certain delegated workflows, executes operations under a higher-privileged security context; the 'Impersonate as Admin' option grants a technician role that elevated execution capability. The vulnerable code path returns NTLM credential material (a NetNTLM challenge/response hash belonging to the impersonated context) to the requesting technician instead of keeping it within the server-side authentication layer. Because NTLM hashes are not salted per-session and can be used for offline cracking or in relay-style attacks against services that accept NTLM authentication, even a limited read exposure of this material is meaningful, though the CVSS scope is unchanged (S:U) and only confidentiality is partially affected (C:L). The CPE data confirms the affected product line is zohocorp:manageengine_admanager_plus, with the wildcard entry plus explicit 8.0 build levels 8000, 8001, 8002, 8010, 8011, 8012, 8020, 8021 and 8022 enumerated as vulnerable, establishing a build-based rather than major-version-based rollout.
Know when Manageengine Admanager Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable web app with low privileged technician role required (PR:L), gated by a specific delegation setting; confidentiality-only disclosure of an NTLM hash, so C:L and I/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Manageengine Admanager Plus
View allMultiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy setti
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. Rated high severity (CVSS 7.5), this vulnerabili
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, l
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of u
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. Rated medium severity (CVSS 6.5), this
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. Rated medium sever
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code exec
Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. Rated critical severity (CVSS 9.8), this vulner
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu
GitHub PoC
Exploit-DB