CVE-2026-3183 is an authentication bypass vulnerability in Zohocorp ManageEngine ADSelfService Plus that affects versions prior to 6524. The issue involves bypassing Multi Factor Authentication through spoofing techniques, classified under CWE-290. The vulnerability has a CVSS 3.1 score of 7.1 with attack vector network, low attack complexity, low privileges required, and no user interaction needed. The impact includes partial confidentiality loss and high integrity impact without availability impact. No official remediation or patch has been announced by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to bypass Multi Factor Authentication controls, potentially leading to unauthorized access with elevated privileges. This compromises the integrity of the authentication process and may allow attackers to perform actions as authenticated users. Confidentiality impact is low, integrity impact is high, and availability is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. In the meantime, consider additional compensating controls around authentication and access management to reduce risk.