What is the CVSS score of CVE-2026-3183?

CVE-2026-3183 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of ManageEngine ADSelfService Plus are affected by CVE-2026-3183?

Zohocorp ManageEngine ADSelfService Plus contains a multi-factor authentication bypass affecting all versions before build 6524 that allows authenticated users to circumvent the second authentication…. A patch is available.

How to fix or mitigate CVE-2026-3183?

Within 24 hours, identify and inventory all ADSelfService Plus instances in the environment, document their current build versions, and restrict network access to the application to trusted networks only. Within 7 days, implement compensating controls: enforce IP-based whitelisting to limit ADSelfService Plus access to a controlled set of source networks, restrict account privileges used by ADSelfService Plus to minimize blast radius if compromised, and increase monitoring and alerting on failed MFA attempts and unauthorized account modifications within the application. Within 30 days, monitor Zohocorp's advisory channel for patch availability (currently unavailable as of analysis date), evaluate alternative identity management platforms, and conduct a forensic review of failed login attempts and account changes dating back to the vulnerability disclosure.

ManageEngine ADSelfService Plus CVE-2026-3183

EUVD-2026-46164 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-07-21 Zohocorp

GHSA-wm5h-jphh-grm9

Authentication Bypass Zoho Manageengine Adselfservice Plus

7.1

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network-facing portal (AV:N/AC:L), but attacker needs valid first-factor credentials to reach the MFA step, so PR:L; bypassing MFA chiefly harms authentication integrity (I:H) with limited confidentiality and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 21, 2026 - 09:17 EUVD

Analysis Generated

Jul 21, 2026 - 08:20 vuln.today

CVE Published

Jul 21, 2026 - 06:58 cve.org

HIGH 7.1

DescriptionCVE.org

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.

AnalysisAI

Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control.

Technical ContextAI

ManageEngine ADSelfService Plus is Zoho/Zohocorp's self-service password management and single sign-on solution for on-premises Active Directory, Azure AD, and other directories; it enforces MFA/2FA for password resets, account unlocks, and portal logins. The single affected CPE is cpe:2.3:a:zohocorp:manageengine_adselfservice_plus, confirming this is the on-prem application rather than a plugin or cloud tenant. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), a class in which the MFA verification step can be spoofed, replayed, skipped, or otherwise not properly enforced, allowing the second factor to be defeated while the first factor still appears satisfied.

RemediationAI

Vendor-released patch: upgrade ManageEngine ADSelfService Plus to build 6524 or later, which the vendor identifies as the fixed release; consult the advisory at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-3183.html for exact upgrade steps and any service-pack instructions. Until the upgrade is applied, restrict network exposure of the ADSelfService Plus portal by placing it behind a VPN or IP allowlist so only trusted networks can reach the login and MFA endpoints (trade-off: remote/roaming users lose direct self-service access), and monitor authentication logs for anomalous MFA-related events or logins that skip the expected second-factor step. Because the flaw defeats MFA itself, also treat any accounts with recently observed suspicious logins as potentially compromised and consider forced credential resets after patching.