CVE-2023-41904

MEDIUM 5.4CVE-2023-41904 · Published 27/09/2023 · updated 17/06/2026

In short

CVE-2023-41904 is a MEDIUM (CVSS 5.4) vulnerability affecting manageengine admanager plus (zohocorp).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.8% of all vulnerabilities.
Fix: update to 7.2 or later.

Package	Affected versions	Patched versions
manageengine admanager plus zohocorp	`= 7.2< 7.2`	`7.2`

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.