CVE-2025-11250Zohocorp Manageengine Adselfservice Plus

NVDCVSS scored by 0fc0942c-577d-436f-ae8e-945763c79b02

Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

Severity Level

CRITICAL(9.1)

Published Date

Jan 13, 2026

Last Modified

Jan 29, 2026

Exploitation Status

No confirmed exploitation yet

Root Weakness (CWE)

See the MITRE CWE entry for the full definition of this weakness.

CVSS v3.1 Base Metrics — Score 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

Affected Versions

Patched Versions

Plan remediation soon. No exploitation is confirmed yet, but the severity is critical.

Check whether you run Zohocorp Manageengine Adselfservice Plus and which version.
Update to a patched version listed above, then confirm the new version.

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Zoho CVEsYou are reading CVE-2025-11250. Get an email when KEV listings, exploits or new CVEs match your stack.

Data last checked: Nov 15, 2026 03:31 UTC