CVE-2021-37918

What it actually does

CVE-2021-37918 is an unauthenticated unrestricted file upload vulnerability in Zoho ManageEngine ADManager Plus version 7110 and earlier. Because the application does not adequately validate uploaded file content, type, extension, or destination, a remote attacker can upload a server-executable payload and cause the ADManager Plus server to execute attacker-controlled code. Successful exploitation can provide remote code execution in the context of the ADManager Plus application/service account, with potential access to Active Directory management functions, stored credentials, configuration data, and the underlying host.

Why it matters to the business

Compromise of ADManager Plus can have severe operational consequences because the product is commonly used to manage Active Directory users, groups, permissions, and administrative workflows. An attacker who gains code execution on this system may be able to steal directory-management credentials, alter user or group settings, create persistence, pivot into domain infrastructure, disrupt identity operations, or use the server as a staging point for broader compromise. The CVSS score is critical and EPSS is high, indicating meaningful likelihood of exploitation despite the vulnerability not being listed in CISA KEV at this time.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable ADManager Plus instance running version 7110 or earlier. They send a crafted HTTP request to a file-upload function that accepts arbitrary content without sufficient validation. The uploaded file is placed in a location where the web application or application server can execute it, or the attacker subsequently invokes the uploaded payload through a web-accessible path. Once executed, the payload runs commands with the privileges of the ADManager Plus service. From there, the attacker may enumerate the host, read product configuration files, collect credentials or tokens, interact with Active Directory through available service permissions, deploy additional tooling, and establish persistence or lateral movement.

How to fix it

Upgrade Zoho ManageEngine ADManager Plus to a vendor-fixed release newer than version 7110. If an exact fixed build is not available in the provided advisory data, use the latest supported ADManager Plus release from Zoho/ManageEngine and confirm that it explicitly includes the fix for CVE-2021-37918. If immediate upgrade is not possible, restrict access to ADManager Plus to trusted administrative networks or VPNs, block internet exposure, enforce strong authentication and MFA where supported, and use network controls or a WAF to limit access to upload endpoints. Review and reduce the privileges of the ADManager Plus service account so compromise of the application does not automatically grant broad domain control. Treat any exposed vulnerable instance as potentially compromised and perform forensic review before returning it to service.

How to confirm the fix worked

Confirm the installed ADManager Plus build is later than 7110 or otherwise documented by the vendor as fixed for this vulnerability. Validate that ADManager Plus is not directly reachable from untrusted networks and that only approved administrative sources can access the application. Review application configuration to ensure upload locations cannot execute server-side code and that file-type validation is enabled in the patched version. Perform a controlled vulnerability scan or authenticated configuration review to verify the product version. Search web/application directories for unexpected executable files, recently modified upload artifacts, and web shells. After patching, attempt only safe, non-destructive validation: confirm arbitrary executable upload attempts are rejected and that uploaded content cannot be invoked as code.

Typical attack path

1. Scan for exposed Zoho ManageEngine ADManager Plus instances.
2. Fingerprint the application version and identify systems running version 7110 or earlier.
3. Submit a crafted unauthenticated file upload request containing executable server-side code or a payload wrapper.
4. Access or trigger the uploaded file to execute code on the ADManager Plus server.
5. Run reconnaissance commands to determine host privileges, domain connectivity, installed security tools, and stored application credentials.
6. Use ADManager Plus privileges or harvested credentials to access Active Directory resources, modify accounts or groups, or pivot to other systems.
7. Deploy persistence, additional payloads, web shells, or remote access tooling and cover tracks by deleting uploaded files or logs.

How to detect it

Review ADManager Plus web access logs, application logs, servlet/application-server logs, and operating system event logs for evidence of suspicious upload activity followed by execution. Look for unauthenticated or unusual HTTP POST requests to file-upload functionality, requests containing executable extensions, abnormal response patterns after uploads, and subsequent GET requests to newly uploaded files. On the host, examine ADManager Plus installation and web directories for unexpected JSP, WAR, class, script, or binary files, especially files created after suspicious upload requests. Check process telemetry for the ADManager Plus Java process spawning command shells, scripting engines, download utilities, archive tools, or reconnaissance commands. Review outbound network connections from the ADManager Plus server to unfamiliar IPs or domains shortly after upload events. Inspect Active Directory audit logs for account creation, group membership changes, privilege grants, password resets, delegation changes, or unusual LDAP/administrative activity originating from the ADManager Plus server or its service account. If EDR is available, hunt for web shell behavior, credential dumping attempts, and lateral movement from the ADManager Plus host.

• ADManager Plus version 7110 or earlier
• ManageEngine ADManager Plus service spawning cmd.exe
• ManageEngine ADManager Plus service spawning powershell.exe
• ManageEngine ADManager Plus service spawning powershell_ise.exe
• ManageEngine ADManager Plus service spawning wscript.exe
• ManageEngine ADManager Plus service spawning cscript.exe
• ManageEngine ADManager Plus service spawning mshta.exe
• ManageEngine ADManager Plus service spawning certutil.exe
• ManageEngine ADManager Plus service spawning bitsadmin.exe
• ManageEngine ADManager Plus service spawning curl.exe
• ManageEngine ADManager Plus service spawning wget.exe
• ManageEngine ADManager Plus service spawning whoami.exe
• ManageEngine ADManager Plus service spawning net.exe
• ManageEngine ADManager Plus service spawning nltest.exe
• ManageEngine ADManager Plus service spawning dsquery.exe
• ManageEngine ADManager Plus service spawning regsvr32.exe
• ManageEngine ADManager Plus service spawning rundll32.exe
• ManageEngine ADManager Plus service spawning java.exe with suspicious child command execution
• HTTP POST requests with uploaded .jsp files to ADManager Plus
• HTTP POST requests with uploaded .war files to ADManager Plus
• HTTP POST requests with uploaded .class files to ADManager Plus
• HTTP GET requests for newly uploaded .jsp files on ADManager Plus
• unexpected .jsp files under ManageEngine ADManager Plus web directories
• unexpected .war files under ManageEngine ADManager Plus web directories
• unexpected .class files under ManageEngine ADManager Plus web directories
• web shell parameters in ADManager Plus requests: cmd=
• web shell parameters in ADManager Plus requests: exec=
• web shell parameters in ADManager Plus requests: command=
• web shell parameters in ADManager Plus requests: powershell

What your security team should do

• Immediately inventory all Zoho ManageEngine ADManager Plus deployments and identify versions 7110 and earlier.
• Prioritize upgrade of all vulnerable instances to the latest supported fixed release, especially any reachable from the internet or broad internal networks.
• Remove public exposure; place ADManager Plus behind VPN, administrative jump hosts, or allowlisted management networks.
• Conduct compromise assessment on vulnerable systems before and after remediation, focusing on uploaded files, suspicious child processes, credential access, and Active Directory changes.
• Rotate credentials used by ADManager Plus, including service accounts and any stored directory-management credentials, if exploitation is suspected or the system was internet-facing while vulnerable.
• Review Active Directory for unauthorized user creation, privilege escalation, group membership changes, delegation changes, password resets, or new scheduled tasks/GPO modifications around the exposure window.
• Deploy SIEM detections for suspicious upload activity, web shell access patterns, and ADManager Plus service spawning command interpreters or scripting engines.
• Apply least privilege to ADManager Plus service accounts and separate routine management privileges from domain-wide administrative privileges.
• Increase monitoring of identity infrastructure because compromise of this product can lead to downstream domain compromise.