CVE-2021-40539

This advisory describes a critical REST API authentication-bypass (CVE-2021-40539, CVSS 9.8) in ManageEngine ADSelfService Plus that allows unauthenticated remote code execution; it was actively exploited to deploy webshells and maintain persistence, attributed to a China-based threat group, and has prompted alerts from FBI/CISA and vendor patches—organisations are advised to apply the September 6, 2021 patch immediately.