Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)
Flags web requests targeting ADSelfService Plus REST API paths linked to CVE-2021-40539 authentication bypass.
- Category
- webserver
- Author
- Sittikorn S, Nuttakorn Tungpoonsup (SigmaHQ), DRL 1.1
- Published
- 2021-09-10
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web requests whose URI query contains specific paths associated with the ADSelfService Plus REST API authentication bypass (CVE-2021-40539). Attackers may use these endpoints to gain unauthorized access, enabling follow-on intrusion and persistence. The detection relies on webserver telemetry that records the full request URI query, matching the presence of the targeted substrings.
Reporting behind it
- therecord.mediahttps://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/
- manageengine.comhttps://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- us-cert.cisa.govhttps://us-cert.cisa.gov/ncas/alerts/aa21-259a
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)
id: 0e68c29a-2994-4dea-93fe-0f62c0b49bea
status: test
description: This rule flags web requests whose URI query contains specific paths associated with the ADSelfService Plus REST API authentication bypass (CVE-2021-40539). Attackers may use these endpoints to gain unauthorized access, enabling follow-on intrusion and persistence. The detection relies on webserver telemetry that records the full request URI query, matching the presence of the targeted substrings.
references:
- https://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml
author: Sittikorn S, Nuttakorn Tungpoonsup, Huntrule Team
date: 2021-09-10
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- cve.2021-40539
- detection.emerging-threats
logsource:
category: webserver
definition: Must be collect log from \ManageEngine\ADSelfService Plus\logs
detection:
selection:
cs-uri-query|contains:
- /help/admin-guide/Reports/ReportGenerate.jsp
- /RestAPI/LogonCustomization
- /RestAPI/Connection
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: fcbb4a77-f368-4945-b046-4499a1da69d1
type: derived