CVE-2025-11670: NTLM Hash Exposure Vulnerability
Published Dec 15, 2025
·Updated
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
Affected Software
11 affected components
Zohocorp ManageEngine ADManager Plus<8025
Zohocorp ManageEngine ADManager Plus<8.0
Zohocorp ManageEngine ADManager Plus=8.0-8000
Zohocorp ManageEngine ADManager Plus=8.0-8001
Zohocorp ManageEngine ADManager Plus=8.0-8002
Zohocorp ManageEngine ADManager Plus=8.0-8010
Zohocorp ManageEngine ADManager Plus=8.0-8011
Zohocorp ManageEngine ADManager Plus=8.0-8012
Zohocorp ManageEngine ADManager Plus=8.0-8020
Zohocorp ManageEngine ADManager Plus=8.0-8021
Zohocorp ManageEngine ADManager Plus=8.0-8022
Event History
Dec 15, 2025
CVE Published
via MITRE·11:11 AM
Data Sourced
via MITRE·11:11 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-11670?
CVE-2025-11670 is considered a high-severity vulnerability due to the potential for NTLM hash exposure.
2
Who is affected by CVE-2025-11670?
CVE-2025-11670 affects Zohocorp ManageEngine ADManager Plus versions prior to 8025.
3
How can I fix CVE-2025-11670?
To fix CVE-2025-11670, upgrade to Zohocorp ManageEngine ADManager Plus version 8025 or later.
4
What type of exploitation is possible with CVE-2025-11670?
CVE-2025-11670 can be exploited by technicians who have the 'Impersonate as Admin' option enabled.
5
What does CVE-2025-11670 expose?
CVE-2025-11670 exposes NTLM hashes, which can lead to unauthorized access if exploited.