CVE-2025-11250

The vulnerability results from improper configuration of authentication filters (CWE-290 — Authentication Bypass by Spoofing). Incorrectly configured filters allow an attacker to bypass access controls and impersonate an authenticated user or administrator. The attack can be conducted remotely, over the network, without the need to possess an account or user interaction.

An attacker can gain unauthorized access to the system with a high level of privileges, resulting in a breach of confidentiality and integrity of data managed by the application, including potentially authentication credentials of Active Directory users.

ManageEngine ADSelfService Plus must be immediately updated to version 6519 or later. Details are available in the official manufacturer's bulletin: https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-11250.html

Zohocorp ManageEngine ADSelfService Plus in versions earlier than 6519