CVE-2010-3272: accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus b...

Security readout for executives and security teams

This flaw affects the password-reset security-question flow in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500. A remote attacker could make password resets easier and potentially take over arbitrary user accounts. The source bundle does not provide a CVSS score or evidence of active exploitation. Exposure is likely where older ADSelfService Plus deployments are still reachable, especially self-service password-reset portals exposed to users or the internet. The bundle does not identify affected operating systems, default configurations, or specific deployment prerequisites. Treat this as a high-priority identity-control issue if ADSelfService Plus is deployed. The business risk is account takeover through password reset abuse, but urgency depends on whether vulnerable builds remain in use and how exposed the portal is. Mitigation focus: Identify all ManageEngine ADSelfService Plus deployments and confirm their build numbers.; Upgrade instances before 4.5 Build 4500 to a fixed vendor-supported release.; Check current vendor guidance for any additional hardening or compensating controls..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.