VulnerabilityAnalyzed

CVE-2025-1723

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling.

HIGH 8.1EPSS 1.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.45% probability · 72th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: zohocorp/manageengine adselfservice plus
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-1723.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.