CVE-2022-28987: Zohocorp ManageEngine Adselfservice Plus

Medium severity, CVSS 5.3. EPSS: 10% chance of exploitation in the next 30 days.

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.

Affected products

• Zohocorp ManageEngine Adselfservice Plus: version 6.1 only

Published 2022-05-20. Last modified 2026-06-17.