Exploit for CVE-2021-40539

kitploit · 2026-08-27

Description

POC for CVE-2021-40539 affecting the tools package.

Entry point

ParametermethodToCall · request body

Path/RestAPI/LogonCustomization

REST API authentication bypass leading to code execution in ManageEngine ADSelfService Plus (CVE-2021-40539) via uploading/executing payload

Affected Zohocorp Manageengine Adselfservice Plus versions

Zohocorp Manageengine Adselfservice Plus< 6.1

All known vulnerabilities by product

Zoho Manageengine Adselfservice Plus

CVSS 9.8 for CVE-2021-40539

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

CVE-2021-40539

Exploit Details

Modified:2026-08-27 00:45

Last Seen:2026-08-27 08:20

Reporter:KitPloit

Other exploits for CVE-2021-40539

CVE-2021-40539

2026-08-27 KitPloitKITPLOIT

CVE-2021-40539

2026-08-27 KitPloitKITPLOIT

ADSelfService-Plus-RCE-CVE-2021-40539

2026-08-26 KitPloitKITPLOIT

CVE-2021-40539

2026-08-26 KitPloitKITPLOIT

APT-Backpack

2026-08-24 KitPloitKITPLOIT

Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus

2024-10-16 Bu0uCatGITHUB

Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus

2024-10-12 lpyydxsGITHUB

Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus

2024-10-12 lpyzdsGITHUB

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DARKSPRINGS-CVE-2021-40539
CVE-2021-40539 POC

Exploit Code

Share

Share on social media: