CVE-2023-35854

CRITICAL

ManageEngine ADSelfService Plus <= 6113 - Authentication Bypass via Session Token Theft

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-35854. PoCs published by bluestarry33.

AI-analyzed exploit summary This PoC exploits CVE-2023-35854, an authentication bypass vulnerability in an unspecified software, to upload a JSP webshell or a Java class payload for remote code execution. It includes multiple stages for checking vulnerability, uploading payloads, and executing commands.

Description

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."

Exploits (1)

nomisec WORKING POC 1 stars
by bluestarry33 · poc
https://github.com/bluestarry33/exp

This PoC exploits CVE-2023-35854, an authentication bypass vulnerability in an unspecified software, to upload a JSP webshell or a Java class payload for remote code execution. It includes multiple stages for checking vulnerability, uploading payloads, and executing commands.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Unspecified (likely a web application with RestAPI endpoints)
No auth needed
Prerequisites: Network access to the target · Vulnerable endpoint exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0505
EPSS Percentile 91.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-306
Status published
Products (2)
zohocorp/manageengine_adselfservice_plus 6.1 (14 CPE variants)
zohocorp/manageengine_adselfservice_plus < 6.1
Published Jun 20, 2023
Tracked Since Feb 18, 2026