VulnerabilityPublished 18 Mar 2019Updated 30 May 2025

CVE-2019-7161: Zoho ManageEngine ADSelfService Plus

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 10:12 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 5.6% chance of exploitation in 30 days – higher than 92% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Mar 2019
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, European organizations should immediately upgrade ADSelfService Plus to a version beyond build 5704 where the fixed key issue is resolved. If an upgrade is not immediately feasible, organizations should consider disabling the vulnerable encryption features or restricting access to the ADSelfService Plus management interfaces to trusted administrators only. Conducting a thorough audit of encrypted data handled by the product is advisable to identify any potential exposure. Organizations should also monitor logs for suspicious activity related to password resets or account changes. Implementing network segmentation and strict access controls around the ADSelfService Plus server can reduce the attack surface. Additionally, organizations should review and enhance their cryptographic policies to ensure that all sensitive data is protected using strong, unique keys per installation or user, and that cryptographic best practices are followed. Finally, raising user awareness about phishing and social engineering attacks can help mitigate risks arising from compromised credentials.

Description

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

Impact

For European organizations, the impact of CVE-2019-7161 can be substantial, especially for those relying on ManageEngine ADSelfService Plus for identity and access management. The exposure of encrypted sensitive data can lead to unauthorized password resets, account takeovers, and lateral movement within corporate networks. This can result in data breaches, regulatory non-compliance (notably with GDPR), reputational damage, and operational disruption. Since ADSelfService Plus is often integrated with Active Directory environments, exploitation could undermine the security of the entire directory service infrastructure. The vulnerability's impact is heightened in sectors with stringent data protection requirements such as finance, healthcare, and government agencies prevalent across Europe. Additionally, the potential for attackers to decrypt sensitive data without needing to compromise individual user credentials or perform complex cryptanalysis lowers the barrier for exploitation, increasing risk.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 8 Jul 2025, 15:10 UTC

Technical details

References

Community reviews

Related threats