CVE-2025-11670

Published: Dec 15, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.

Affected (10)

Products: Zohocorp: Manageengine Admanager Plus

Zohocorp

1 product

Manageengine Admanager Plus

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Admanager Plus	Before 8.0
Zohocorp Manageengine Admanager Plus	Version 8.0 8000
Zohocorp Manageengine Admanager Plus	Version 8.0 8001
Zohocorp Manageengine Admanager Plus	Version 8.0 8002
Zohocorp Manageengine Admanager Plus	Version 8.0 8010
Zohocorp Manageengine Admanager Plus	Version 8.0 8011
Zohocorp Manageengine Admanager Plus	Version 8.0 8012
Zohocorp Manageengine Admanager Plus	Version 8.0 8020
Zohocorp Manageengine Admanager Plus	Version 8.0 8021
Zohocorp Manageengine Admanager Plus	Version 8.0 8022

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Vendor Advisory

Timeline

No history available yet.