CVE-2021-37926

What it actually does

Zoho ManageEngine ADManager Plus 7110 and earlier contains an unauthenticated unrestricted file upload weakness that can allow a remote attacker to place attacker-controlled files on the application server. If the uploaded file is a server-executable payload, such as a JSP web shell in the web application path, the attacker can execute operating system commands in the context of the ADManager Plus service account. Because the service commonly has connectivity to Active Directory and other identity infrastructure, successful exploitation can lead to full application compromise, credential theft, directory manipulation, lateral movement, and complete loss of confidentiality, integrity, and availability on the host.

Why it matters to the business

A vulnerable ADManager Plus deployment can be taken over remotely without credentials, putting identity administration workflows and potentially Active Directory management at risk. Operational consequences may include unauthorized account creation or modification, exposure of directory data, disruption of help desk and identity management operations, and a foothold for broader enterprise compromise. Although this CVE is not listed in CISA KEV and the provided exploit maturity is not confirmed, the CVSS 9.8 severity and high EPSS score indicate meaningful internet-scale exploitation likelihood and justify urgent remediation, especially for externally reachable systems.

How an attack unfolds

An attacker first identifies an exposed Zoho ManageEngine ADManager Plus instance and confirms that it is running build 7110 or earlier. The attacker then sends a crafted HTTP file-upload request to the vulnerable functionality, bypassing intended file type or path restrictions. Instead of uploading a benign file, the attacker uploads executable server-side content such as a JSP web shell or other payload into a location that the application server can serve or execute. The attacker then requests the uploaded payload over HTTP, causing the ADManager Plus application server to run attacker-supplied code. From there, the attacker can execute commands as the ADManager Plus service account, enumerate files and configuration, harvest credentials or tokens, establish persistence, pivot to Active Directory-connected systems, and perform unauthorized administrative actions depending on the privileges available to the service and application.

How to fix it

Upgrade Zoho ManageEngine ADManager Plus to a supported vendor release newer than 7110; do not operate build 7110 or earlier. If an exact fixed build is not available in internal package metadata, confirm the current fixed build directly from Zoho/ManageEngine advisories and release notes, then deploy the latest supported version. Until upgraded, remove external exposure, restrict access to trusted administrative networks or VPN, enforce firewall allowlists, and disable or block vulnerable upload functionality where feasible. Review the ADManager Plus service account privileges and reduce them to the minimum required. Rotate credentials and secrets accessible to the application after remediation if compromise cannot be ruled out. Remove any unexpected uploaded executable files, JSPs, WARs, scripts, or web shells from application directories only after preserving forensic evidence where incident response is required.

How to confirm the fix worked

Confirm that every ADManager Plus instance reports a build newer than 7110 and is on a supported release. Validate from the application UI, installed build files, package inventory, and vendor update logs rather than relying only on network banners. Perform an authenticated administrative check to confirm the upgrade completed successfully and the service restarted into the expected build. From a security testing perspective, verify that unauthenticated file-upload attempts are rejected and that uploaded content cannot be written to executable web paths or invoked as server-side code. Scan internet-facing assets and internal management networks for ADManager Plus exposure. Inspect application web directories for unexpected executable files created before the upgrade date, especially JSP, WAR, class, script, or archive files.

Typical attack path

1. Scan for internet-facing or network-accessible Zoho ManageEngine ADManager Plus instances.
2. Determine whether the instance is running version 7110 or earlier through exposed version information, UI fingerprints, headers, or behavioral testing.
3. Submit a crafted unauthenticated file-upload request containing executable server-side content such as a JSP web shell.
4. Place the uploaded file in, or cause it to be moved to, a web-accessible application directory.
5. Invoke the uploaded payload over HTTP to execute commands on the ADManager Plus server.
6. Run discovery commands to identify host privileges, application paths, stored credentials, network access, and Active Directory connectivity.
7. Use the compromised application context to steal sensitive data, modify identity objects, deploy additional tooling, or move laterally.
8. Delete or alter uploaded files, logs, or timestamps to reduce evidence of compromise.

How to detect it

Investigate ADManager Plus web, application, and operating system logs for suspicious upload activity and post-upload execution. Key sources include HTTP access logs, application logs, Tomcat/catalina logs, wrapper/service logs, Windows Event Logs or Linux audit logs, EDR process telemetry, file creation telemetry, and proxy or WAF logs. Look for unauthenticated or unusual multipart upload requests followed shortly by HTTP GET or POST requests to newly created JSP, WAR, or script files. Examine ADManager Plus installation directories, webapps directories, temporary upload directories, Tomcat work directories, and backup/update directories for unexpected executable content, especially files with recent creation times, random names, or web-shell-like parameters. On the host, hunt for the ADManager Plus Java/Tomcat process spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl, wget, bash, sh, perl, or python. Review outbound network connections from the ADManager Plus server to unfamiliar IP addresses after suspicious web requests. Because the product interacts with directory services, also review identity audit logs for unusual administrative actions, including unexpected user creation, privilege escalation, password resets, group membership changes, and delegated permission changes performed by the ADManager Plus service account or application administrators.

• multipart/form-data
• Content-Disposition: form-data
• filename="*.jsp"
• filename="*.war"
• filename="*.jspx"
• filename="*.class"
• ManageEngine\ADManager Plus\webapps\
• ManageEngine/ADManager Plus/webapps/
• ManageEngine\ADManager Plus\work\
• ManageEngine/ADManager Plus/work/
• ManageEngine\ADManager Plus\temp\
• ManageEngine/ADManager Plus/temp/
• .jsp?cmd=
• .jspx?cmd=
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• curl http
• wget http
• /bin/sh -c
• /bin/bash -c
• java.exe spawned cmd.exe
• java.exe spawned powershell.exe
• java spawned /bin/sh
• java spawned /bin/bash

What your security team should do

• Treat ADManager Plus 7110 and earlier as high priority for emergency patching or isolation because the flaw is unauthenticated remote code execution with a high EPSS score.
• Inventory all ADManager Plus instances, including non-production and internally exposed servers, and confirm none are running build 7110 or earlier.
• Upgrade to the latest supported vendor build and verify the installed version after restart.
• Immediately restrict network access to ADManager Plus to trusted administrators and management networks only.
• Hunt for evidence of prior exploitation before assuming patching alone is sufficient, focusing on suspicious uploads, web shells, and child processes spawned by the Java/Tomcat service.
• Review and rotate credentials stored in or accessible to ADManager Plus if suspicious activity is found or logs are incomplete.
• Audit Active Directory changes made through ADManager Plus around the suspected exposure window, including new accounts, privilege changes, group membership changes, password resets, and delegation changes.
• Add detections for Java/Tomcat spawning command shells or scripting interpreters on ADManager Plus hosts.
• Ensure ADManager Plus service accounts follow least privilege and are not domain administrators unless explicitly required and compensating controls exist.