Zoho Patches Critical “9.1” Flaw in ADSelfService Plus

ManageEngine ADSelfService Plus has a critical vulnerability (CVE-2025-11250, CVSS 9.1) affecting builds 6518 and earlier; the vendor released a patch in build 6519 on 2025-10-01 and urges immediate updates. The flaw—discovered via the Zoho BugBounty program—could allow unauthorized access or system compromise involving Active Directory credentials, though specific exploit details and evidence of active exploitation are not provided.