CVE-2022-28810: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

CVE-2022-28810 is a remote code execution vulnerability affecting Zoho ManageEngine ADSelfService Plus. According to available details, it permits remote code execution when a password change or reset is performed. This matters to IT and security teams because ADSelfService Plus commonly sits at the edge of identity workflows, handling self-service password operations for Active Directory environments; successful abuse can give an attacker a foothold with the privileges of the application process.

Public technical detail is limited to the high-level description and the associated weakness classes. Defenders should treat any internet-reachable or broadly accessible instance as high priority until the vendor advisory and their own inventory confirm otherwise.

How it works

The vulnerability is associated with CWE-78 (improper neutralization of special elements used in an OS command) and CWE-259 (use of hard-coded password). In products of this class, command-injection flaws typically arise when user-controlled input that reaches a password-change or reset workflow is insufficiently sanitized before being passed to an operating-system command or script. A hard-coded credential weakness can further lower the barrier to authenticating or elevating within the application so that the injection path becomes reachable.

An attacker who can interact with the password-change or reset functionality may therefore be able to inject commands that execute with the privileges of the ADSelfService Plus service. Exact request parameters, authentication requirements, and payload construction are not specified in the provided facts; those mechanics must be confirmed against the vendor advisory. The practical outcome is remote code execution on the host running the product, which can then be used for persistence, credential theft, or lateral movement into the directory environment the product serves.

Am I affected? How to find it in your systems

Zoho ManageEngine ADSelfService Plus is typically deployed on Windows servers that integrate with Active Directory for self-service password reset, account unlock, and related identity tasks. It may be exposed to the corporate network, to partner networks, or, in some configurations, to the internet.

• Inventory all hosts running ManageEngine products; look for the ADSelfService Plus service, installation directories, and listening ports associated with the application.
• Query software asset management, configuration-management databases, and vulnerability scanners for “ADSelfService Plus” or the ManageEngine product family.
• Confirm the exact build or version against the vendor advisory; the facts supplied here do not list affected version ranges, so do not rely on assumptions.
• Review network diagrams and firewall rules for any external or cross-segment access to the application’s web interface.
• Examine application and system logs for anomalous password-change or reset activity, unexpected process creation by the service account, or outbound connections initiated shortly after such operations. Telemetry from endpoint detection tools can surface command-line activity spawned by the ADSelfService Plus process.

If the product is present and reachable, treat it as potentially affected until the vendor’s fixed version is verified as installed.

How to remediate

The required action is to apply updates per the vendor’s instructions. Obtain the security advisory and the corresponding patch or upgraded build for ADSelfService Plus directly from Zoho ManageEngine, validate the package integrity, and deploy it through your normal change process. After installation, restart the service as directed and confirm the new version string.

Once the patch is in place, harden the installation for this class of weakness:

• Ensure the service account runs with least privilege and is not a domain administrator.
• Remove or rotate any hard-coded or default credentials that may exist in configuration files or scripts (consistent with CWE-259 remediation).
• Restrict the password-change and reset endpoints to authenticated, authorized users only; disable anonymous or guest access if the product permits it.
• Apply input-validation and output-encoding controls at any reverse-proxy or web-application firewall in front of the product, focusing on characters commonly used in command injection.
• Keep the underlying operating system and Java runtime (if used) fully patched so that secondary escalation paths are reduced.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the host so that only necessary management and directory-service networks can reach it; block internet and untrusted-segment access at the firewall.
• Place a web-application firewall or reverse proxy in front of the interface and enable rules that detect or block OS-command metacharacters in parameters related to password operations.
• If operationally feasible, temporarily disable the self-service password-change and reset features or restrict them to a tightly controlled internal network.
• Increase monitoring: alert on process creation by the ADSelfService Plus service account, on unusual command lines, and on authentication failures or successes tied to the password-reset workflow.
• Ensure endpoint detection and response agents are active on the host and that their telemetry is forwarded to a central SIEM for rapid investigation.

These measures do not eliminate the vulnerability; they only buy time until the official update is installed.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities in identity-management products frequently lead to credential compromise and broader breaches. Known ransomware use of this specific CVE is not documented in the provided facts, but any successful exploitation should still be treated as a potential incident. Review logs for signs of compromise, rotate credentials that the application could have accessed, and examine Active Directory for unauthorized changes. As an additional check, individuals can run a free exposure scan of their email addresses against known breach data sets to determine whether personal credentials have appeared in prior incidents.