CVE-2021-42847

What it actually does

CVE-2021-42847 is a critical unauthenticated remote code execution vulnerability in Zoho ManageEngine ADAudit Plus versions before 7006. The flaw allows a remote attacker to write arbitrary files to the application host and then execute those files, which can result in full compromise of the ADAudit Plus server. Because the CVSS vector is network-accessible, low-complexity, requires no privileges, and requires no user interaction, successful exploitation can provide high-impact compromise of confidentiality, integrity, and availability.

Why it matters to the business

A compromised ADAudit Plus server can give attackers control over a system that is commonly connected to Active Directory auditing, authentication event collection, and privileged operational telemetry. Business consequences may include theft of domain audit data, credential harvesting, tampering with audit records, deployment of malware or web shells, lateral movement into Windows domain infrastructure, service disruption, and loss of trust in security monitoring data. The vulnerability is weaponized and has a high EPSS score, so internet-exposed or unpatched deployments should be treated as high-priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed ManageEngine ADAudit Plus instance running a vulnerable build before 7006. Because exploitation requires no authentication, the attacker can directly interact with the vulnerable application endpoint over the network. They abuse the arbitrary file write condition to place a malicious file, commonly a web shell, script, or executable payload, into a location where the ADAudit Plus application or underlying web server will execute it. The attacker then triggers execution of that file to run commands with the privileges of the ADAudit Plus service account. From there, they may establish persistence, dump configuration files, harvest credentials or directory audit data, modify or delete logs, stage additional tools, and pivot to adjacent Active Directory or Windows infrastructure.

How to fix it

Upgrade Zoho ManageEngine ADAudit Plus to build 7006 or later. If a later vendor-supported release is available, upgrade to the latest stable build rather than only the minimum fixed build. If immediate patching is not possible, restrict network access to ADAudit Plus to trusted administrative networks or VPN users only, block direct internet exposure, enforce host-based firewall rules, and monitor for unexpected file creation in application directories. Because the vulnerability permits arbitrary file write and execution, exposed vulnerable systems should be assessed for compromise before being returned to service. Rotate credentials and service account secrets that may have been accessible from the ADAudit Plus host if compromise is suspected.

How to confirm the fix worked

Confirm the installed ADAudit Plus build is 7006 or later using the product administration interface, installation metadata, or vendor-supported version check procedures. Verify that the service has restarted cleanly after upgrade and that the application is no longer running vulnerable binaries. Perform external and internal exposure checks to ensure ADAudit Plus is not reachable from untrusted networks unless explicitly required. Review application directories for recently created or modified executable files, scripts, JSPs, WARs, batch files, PowerShell scripts, or binaries. Validate that web access controls and reverse proxy rules do not permit unauthenticated access to sensitive upload or execution paths. If vulnerability scanners are used, run an authenticated product-version check and a safe detection plugin rather than relying only on banner information.

Typical attack path

1. Scan for internet-facing or internally reachable Zoho ManageEngine ADAudit Plus servers.
2. Fingerprint the product version or infer vulnerability based on exposed behavior and build information.
3. Send a crafted unauthenticated request that abuses the arbitrary file write weakness.
4. Write a malicious payload such as a web shell, script, JSP file, or executable to a server-side executable path.
5. Invoke the uploaded payload to execute operating system commands under the ADAudit Plus service context.
6. Perform discovery, credential access, data collection, persistence, or lateral movement from the compromised host.
7. Attempt to clear application, web server, and operating system logs to conceal activity.

How to detect it

Investigate ADAudit Plus application logs, embedded web server or reverse proxy access logs, Windows Event Logs, endpoint detection telemetry, and filesystem timestamps. Look for unauthenticated requests followed by creation of new files in ADAudit Plus application directories, especially executable or script-like files. Review process lineage for Java, Tomcat, wrapper, or ManageEngine service processes spawning command interpreters such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, or mshta.exe. Examine Windows Security logs for new local users, service creation, scheduled tasks, suspicious logons, or privilege escalation after suspicious web requests. Check Sysmon or EDR telemetry for file creation events in ManageEngine directories and outbound network connections from spawned shell or script processes. Review ADAudit Plus, web access, and reverse proxy logs for requests to unexpected JSP, WAR, script, or uploaded payload names, especially followed by HTTP 200 responses and command-like query parameters. Because public reporting for this input does not provide a single unique exploit string, detection should focus on behavioral indicators: arbitrary file creation, web shell access, and child process execution from the application service account.

• ManageEngine ADAudit Plus build < 7006
• cmd.exe spawned by java.exe
• cmd.exe spawned by tomcat*.exe
• cmd.exe spawned by wrapper.exe
• powershell.exe spawned by java.exe
• powershell.exe spawned by tomcat*.exe
• powershell.exe spawned by wrapper.exe
• wscript.exe spawned by java.exe
• cscript.exe spawned by java.exe
• certutil.exe spawned by java.exe
• bitsadmin.exe spawned by java.exe
• rundll32.exe spawned by java.exe
• regsvr32.exe spawned by java.exe
• mshta.exe spawned by java.exe
• *.jsp created under ManageEngine ADAudit Plus installation directory
• *.war created under ManageEngine ADAudit Plus installation directory
• *.bat created under ManageEngine ADAudit Plus installation directory
• *.ps1 created under ManageEngine ADAudit Plus installation directory
• *.exe created under ManageEngine ADAudit Plus installation directory
• HTTP request to newly created .jsp file under ADAudit Plus web path
• HTTP 200 response for unexpected .jsp file in ADAudit Plus
• Windows Event ID 4688 with parent process java.exe and child process cmd.exe
• Windows Event ID 4688 with parent process java.exe and child process powershell.exe
• Windows Event ID 7045 service created after ADAudit Plus web request
• Sysmon Event ID 1 parent image java.exe child image cmd.exe
• Sysmon Event ID 1 parent image java.exe child image powershell.exe
• Sysmon Event ID 11 file creation under ManageEngine ADAudit Plus directory

What your security team should do

• Immediately inventory all Zoho ManageEngine ADAudit Plus deployments and identify any builds earlier than 7006.
• Prioritize patching or isolation of any internet-facing or broadly reachable ADAudit Plus servers because exploitation is weaponized and the EPSS score is high.
• Upgrade to ADAudit Plus build 7006 or later, preferably the latest supported release.
• Before patching highly exposed systems, preserve relevant logs and filesystem metadata for investigation to avoid losing evidence during upgrade or restart.
• Hunt for suspicious files written to ADAudit Plus installation, web application, temporary, and working directories.
• Review process execution on ADAudit Plus hosts for child processes spawned by Java, Tomcat, or ManageEngine service processes, especially command shells and scripting engines.
• Restrict ADAudit Plus access to trusted administrative networks and remove unnecessary internet exposure.
• Rotate credentials, API keys, service account passwords, and directory integration secrets if there is evidence of compromise.
• Increase monitoring of Active Directory, privileged account activity, and lateral movement paths from any server that hosted a vulnerable ADAudit Plus instance.
• Create SIEM detections for unexpected executable content, web shell-like access patterns, and suspicious command execution originating from the ADAudit Plus application service.