What is the CVSS score of CVE-2026-75791?

CVE-2026-75791 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 1.7%.

Which versions of ADSelfService Plus are affected by CVE-2026-75791?

ManageEngine ADSelfService Plus deployments before build 7001 contain a high-severity missing-authentication flaw in the REST API that remote, unauthenticated attackers could use to reach protected…. A patch is available.

How to fix or mitigate CVE-2026-75791?

No vendor-released patch identified at time of analysis; vendor advisory indicates build 7001 remediates exposure. Within 24 hours, inventory all ManageEngine ADSelfService Plus instances, identify any build before 7001, and immediately restrict internet exposure by placing them behind VPN, IP allowlisting, or disabling external REST API access, while reviewing logs for anomalous unauthenticated API calls. Within 7 days, apply vendor-released patch or upgrade to build 7001 if available, or engage ManageEngine support for a fixed build; if no patch is available, enforce network segmentation, least-privilege access, and enhanced monitoring for pre-7001 systems. Within 30 days, verify all instances are on build 7001 or a vendor-approved remediated version, validate that compensating controls remain effective, and complete a post-remediation review with identity and security teams.

ADSelfService Plus CVE-2026-75791

EUVD-2026-84364 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-09-22 Zohocorp

GHSA-xcf2-p4gr-c87c

Authentication Bypass Java Zoho Manageengine Adselfservice Plus Zohocorp

8.6

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

8.6 HIGH

Unauthenticated network REST bypass (AV:N/AC:L/PR:N/UI:N) with no scope change; I retain the vendor's C:L/I:L/A:H impact as the advisory gives no detail to justify altering it.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 22, 2026 - 13:40 vuln.today

tag: Java added

Patch available

Sep 22, 2026 - 13:01 EUVD

Analysis Generated

Sep 22, 2026 - 12:46 vuln.today

CVE Published

Sep 22, 2026 - 12:03 cve.org

HIGH 8.6

DescriptionCVE.org

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

Articles & Coverage 1

News 10 New Java Vulnerabilities - 10 High Severity, No POC Available Sep 23, 2026

AnalysisAI

Missing authentication in the ManageEngine ADSelfService Plus REST API (all builds before 7001) lets remote, unauthenticated attackers reach API functionality that should require a valid session or credential, as classified under CWE-306. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (8.6), meaning no credentials and no user interaction are needed, with the highest rated component being availability impact and more limited confidentiality/integrity effects - the exact reachable endpoints are not disclosed in the vendor advisory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker needs network reachability to the ADSelfService Plus REST API on an instance running a build before 7001; no credentials, no user interaction, and no special client-side configuration are required (AV:N/AC:L/PR:N/UI:N, CWE-306 missing authentication). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine priority-worthy finding despite thin public data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to ADSelfService Plus build 7001 or later - this is the vendor-released fix and the only remediation that closes the authentication gap; confirm the installed build from the product's About/Update panel after applying and validate that the REST API rejects unauthenticated requests. … Detailed patch versions, workarounds, and compensating controls in full report.