# CVE-2026-75791

Auth bypass in ManageEngine ADSelfService Plus REST API enabling account takeover.

- Page: https://www.vulneraibility.com/cve/CVE-2026-75791
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.83% (percentile 79.0)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-22)
- Weakness: CWE-306
- Published: 2026-09-22

## Affected versions

- Zohocorp ManageEngine ADSelfService Plus: affected < 7001

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authentication bypass via REST API allows remote attackers to reset passwords, access or impersonate user accounts and escalate access.

## Action

Immediate action required

## Recommendation

Upgrade to build 7001+, restrict REST API access, rotate affected credentials.

## References

- [other] https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-75791.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.