Zoho Patches Critical “9.1” Flaw in ADSelfService Plus

Zoho has patched a critical vulnerability in ADSelfService Plus, tracked as CVE-2025-11250, which carries a CVSS score of 9.1. The flaw affects all versions on Builds 6518 and earlier, with the vulnerability officially resolved in Build 6519, released on 01 October 2025. Administrators are urged to upgrade their ADSelfService Plus instances to build 6519 using the service pack, according to ManageEngine.

The issue was identified internally rather than by an external researcher, and discovery was credited to a Zoho BugBounty report. Given that ADSelfService Plus interacts directly with Active Directory credentials, unpatched instances pose a significant risk to identity infrastructure and overall security. The advisory notes that while specific exploit details have been kept confidential, the critical rating implies that successful exploitation could lead to unauthorized access or system compromise.

In light of the high severity, organisations should prioritise applying the patch to mitigate potential compromise. according to ManageEngine