CVE-2021-37539

What it actually does

Zoho ManageEngine ADManager Plus versions before 7111 contain an unrestricted file upload / improper input validation vulnerability that can lead to unauthenticated remote code execution. Because the CVSS vector indicates network access, low attack complexity, no required privileges, and no user interaction, an attacker may be able to send crafted requests to the ADManager Plus web interface that cause the application to accept and place attacker-controlled files in an executable context. Successful exploitation can allow arbitrary code execution with the privileges of the ADManager Plus service, potentially exposing Active Directory management functions, stored credentials, configuration data, and the underlying server.

Why it matters to the business

A successful compromise of ADManager Plus can have severe operational consequences because the product is commonly used to administer Active Directory identities, groups, and access. Attackers who gain code execution on this system may be able to pivot into identity infrastructure, steal sensitive data, modify directory objects, create or manipulate accounts, disrupt administrative workflows, or use the server as a foothold for broader enterprise compromise. The EPSS score is very high, indicating a comparatively high likelihood of exploitation activity in the wild even though this CVE is not currently listed in CISA KEV and is not flagged as ransomware-associated.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable ADManager Plus instance running a version earlier than 7111. They then interact with the web application and submit a crafted upload request that bypasses intended file type, path, or content validation. If the application stores the uploaded content in a location where it can be invoked by the web server or application runtime, the attacker accesses that uploaded payload to execute commands on the server. From there, the attacker may deploy a web shell, run operating system commands, enumerate configuration files and credentials, access ADManager Plus data, and attempt lateral movement toward Active Directory or other administrative systems.

How to fix it

Upgrade Zoho ManageEngine ADManager Plus to version 7111 or later. If an exact vendor-fixed version newer than 7111 is available for the deployed branch, install the latest supported build rather than only the minimum fixed release. Until upgraded, restrict access to the ADManager Plus web interface using VPN, firewall allowlists, reverse proxy controls, or management-network segmentation; block direct internet exposure; and limit service account privileges to the minimum required. Review and harden upload handling where configurable, remove unknown uploaded files or web shells, rotate credentials that may be stored or accessible to the application, and assess the host for post-exploitation activity before returning it to service.

How to confirm the fix worked

Confirm the deployed ADManager Plus build is 7111 or later through the product console, vendor build information, installed package metadata, or application About page. Verify that the web interface is not publicly reachable unless explicitly required and protected by compensating controls. Review application directories for unexpected uploaded executable files, scripts, JSP files, archives, or recently modified web content. Test exposure with an authenticated or controlled vulnerability scanner that can identify ManageEngine ADManager Plus versions, and validate that upload endpoints reject unsafe file types, path traversal attempts, and executable content. After patching, restart the application if required and confirm the patched build remains in effect after service restart.

Typical attack path

1. Discover a Zoho ManageEngine ADManager Plus web interface exposed to the network.
2. Fingerprint the product and determine whether the version is earlier than 7111.
3. Send a crafted file upload request that abuses insufficient validation controls.
4. Place attacker-controlled content in a web-accessible or executable location.
5. Invoke the uploaded payload to execute commands remotely.
6. Establish persistence, commonly through a web shell or additional tooling.
7. Enumerate application configuration, service permissions, credentials, and directory-management capabilities.
8. Pivot to identity infrastructure or other internal systems using access obtained from the compromised server.

How to detect it

Review ADManager Plus web access logs, application logs, reverse proxy logs, EDR telemetry, Windows Event Logs, and network flow data for signs of suspicious file upload followed by execution. Focus on POST requests to upload-capable endpoints, unusual file extensions in web-accessible directories, requests that reference uploaded JSP or script files, and abnormal HTTP 200 responses immediately after upload activity. On Windows hosts, investigate process creation where the ADManager Plus Java service spawns command interpreters or scripting tools such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, or rundll32.exe. Look for newly created or recently modified files under ADManager Plus installation and web application directories, especially JSP files or archive files with suspicious names. Correlate suspicious activity with outbound connections from the ADManager Plus server to unfamiliar IP addresses, unexpected account or group changes in Active Directory, and authentication events originating from the ADManager Plus host outside normal administrative patterns.

• ManageEngine ADManager Plus version < 7111
• /ADManager
• /ADManager Plus
• POST
• multipart/form-data
• .jsp
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• certutil.exe
• bitsadmin.exe
• mshta.exe
• rundll32.exe
• AdventNet
• ManageEngine
• ADManager Plus

What your security team should do

• Prioritize upgrade of all Zoho ManageEngine ADManager Plus instances to version 7111 or later due to the critical CVSS score and very high EPSS likelihood.
• Immediately remove public internet exposure for ADManager Plus where possible; restrict access to trusted administrative networks only.
• Hunt for evidence of prior exploitation, especially suspicious uploads, JSP/web shell artifacts, child processes spawned by the ADManager Plus service, and unexpected outbound connections.
• Review ADManager Plus service account permissions and reduce privileges where possible to limit impact from application compromise.
• Rotate credentials, API keys, and directory-management secrets that may be stored in or accessible from ADManager Plus if compromise is suspected.
• Enable centralized logging for web access logs, application logs, Windows event logs, process creation telemetry, and EDR alerts on the ADManager Plus host.
• Perform a broader identity-infrastructure review if exploitation is confirmed, including new or modified privileged users, group membership changes, delegated permissions, and suspicious directory operations.