ManageEngine ADSelfService Plus REST API Authentication Bypass

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-75791 is an authentication bypass vulnerability affecting Zoho ManageEngine ADSelfService Plus versions before build 7001, specifically targeting the REST API endpoint. This vulnerability is critical because ADSelfService Plus is widely deployed in enterprise environments for self-service password management and identity verification. Organizations using vulnerable versions can be compromised without valid credentials, allowing attackers to bypass fundamental authentication controls and gain unauthorized access to sensitive identity and access management functionality. The high CVSS score of 8.6 reflects the severity of unauthenticated API access in identity-critical infrastructure.

Casky's 283 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns associated with this vulnerability across two primary MITRE ATT&CK tactics: Privilege Escalation (TA0004) and Credential Access (TA0006). Practitioners using Casky would see detections for CWE-306 violations—Missing Authentication for Critical Function—paired with anomalous REST API calls that bypass session validation. The platform's skills identify suspicious patterns such as unauthenticated requests to sensitive endpoints, direct API calls without proper token validation, and lateral movement attempts following successful authentication bypass. Security teams would observe findings highlighting API requests originating from unexpected sources, mass credential queries, and account modification activities performed without proper authentication context—all hallmarks of exploitation leveraging this vulnerability before patches are applied to build 7001 or later.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75791.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75791

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75791. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn