CVE-2023-41904: Zohocorp ManageEngine Admanager Plus

Medium severity, CVSS 5.4. EPSS: 2.4% chance of exploitation in the next 30 days.

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

Affected products

• Zohocorp ManageEngine Admanager Plus: before 7.2 (fixed in 7.2); version 7.2 only

Published 2023-09-27. Last modified 2026-06-17.