CVE-2025-11670CWE-200information-disclosure

CVE-2025-11670

Medium · published December 15, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.

This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-12-15T16:15Z
Affected products (10)
ProductVersionsFixed in
zohocorp/manageengine_admanager_plus< 8.08.0
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
zohocorp/manageengine_admanager_plusall versions—
References (1)
https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html · 0fc0942c-577d-436f-ae8e-945763c79b02
EPSS history
Timeline
  • 15 DEC 11:11Z
    NTLM Hash Exposure Vulnerability
    cvelistv5