CVE-2024-0252highCWE-94

CVE-2024-0252: high-severity vulnerability in ManageEngine ADSelfService Plus

Remote code execution

Published · Updated

Follow this CVE+ Monitor ADSelfService Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 7.8%
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
ManageEngine · ADSelfService Plus
Related CVEs — ManageEngine ADSelfService Plus

In the same product, most dangerous first.

CVE-2025-3833HIGHSQL InjectionEPSS 50.5%CVE-2023-35719MEDIUMManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass VulnerabilityEPSS 24.6%CVE-2024-27310MEDIUMDOS VulnerabilityEPSS 2.3%CVE-2025-1723HIGHAccount takeoverEPSS 1.5%