Zoho ManageEngine ADSelfService Plus CVE-2021-40539 (REST API authentication bypass to remote code execution, CISA KEV, AA21-259A): which build fixes it and what should I do if the server may have been compromised?

What it is: CVE-2021-40539 is an authentication bypass in the REST API of ManageEngine ADSelfService Plus, the self-service password reset and single sign-on tool for Active Directory. An unauthenticated attacker could reach admin functions and run code on the server. It was exploited from August 2021, before and after Zoho's fix: attackers planted web shells, stole credentials, moved laterally and exfiltrated Active Directory data (including NTDS.dit). CISA, the FBI and the Coast Guard Cyber Command issued advisory AA21-259A, and it's in the KEV catalog. Because the product sits next to Active Directory, a compromise can expose the whole domain. Am I affected: - ADSelfService Plus builds earlier than 6114 (fix released September 6, 2021). Check the build in the product's About/Help page. - Highest risk if the server was reachable from the internet. Fix: 1. Upgrade to build 6114 or later (today, the latest build) using Zoho's update pack. 2. Make sure ADSelfService Plus isn't directly reachable from the internet; publish it only through a VPN or a reverse proxy with access control. 3. Hunt for compromise even if it looks clean (the attackers ran cleanup scripts), using the indicators in AA21-259A and Zoho's guide: unexpected JSP files (CISA lists ReportGenerate.jsp under help/admin-guide/Reports and adap.jsp under html/promotion), a service.cer file that is really a web shell, custom.bat/custom.txt in C:\Users\Public, and suspicious REST API requests in the product's access logs. 4. If you find signs of compromise or NTDS.dit theft: rebuild the server, and follow CISA's advice for the domain: domain-wide password resets and a double reset of the Kerberos TGT (krbtgt) account password, plus a review of privileged accounts. Verify: the product shows build 6114+, the indicators above are absent, and the server isn't exposed to the internet. Sources: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-259a https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html https://nvd.nist.gov/vuln/detail/CVE-2021-40539