CVE-2026-74849: ManageEngine ADSelfService Plus RCE Flaw

CVE-2026-74849 Overview

CVE-2026-74849 is a remote code execution vulnerability affecting Zohocorp ManageEngine ADSelfService Plus versions prior to build 7001. The flaw resides in the Graphical Identification and Authentication (GINA) client component, which integrates ADSelfService Plus with the Windows logon workflow. An unauthenticated network-based attacker can trigger the vulnerability to execute arbitrary operating system commands on affected systems. The issue is categorized under [CWE-78] (OS Command Injection). The Exploit Prediction Scoring System (EPSS) places this CVE in the 91st percentile, indicating elevated likelihood of exploitation activity relative to other published vulnerabilities.

Critical Impact
Unauthenticated attackers can execute arbitrary OS commands on hosts running the vulnerable ADSelfService Plus GINA client, enabling full system compromise.

Affected Products

Zohocorp ManageEngine ADSelfService Plus builds prior to 7001
ADSelfService Plus GINA client component on Windows endpoints
Windows workstations enrolled with the vulnerable GINA/CP integration

Discovery Timeline

2026-09-22 - CVE-2026-74849 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-74849

Vulnerability Analysis

ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on platform for Active Directory. The GINA (Graphical Identification and Authentication) client is a Windows logon extension that lets users reset passwords and unlock accounts directly from the logon screen. Because the GINA client runs within the Windows authentication pipeline, code executed through it inherits elevated privileges on the endpoint.

The vulnerability in builds before 7001 allows attacker-supplied input to reach an operating system command execution path without sufficient sanitization. Successful exploitation permits arbitrary command execution over the network, with impact on system confidentiality, integrity, and availability.

Root Cause

The defect maps to [CWE-78], improper neutralization of special elements used in an OS command. Input processed by the GINA client is passed to a command execution context without adequate validation or escaping, allowing an attacker to inject additional shell metacharacters or commands.

Attack Vector

Exploitation requires network access to the vulnerable GINA client endpoint. No authentication or user interaction is required. An attacker crafts a request that embeds command syntax within a parameter processed by the GINA client, causing the injected commands to execute in the security context of the client process on the target host.

No public proof-of-concept exploit has been published at the time of writing. Refer to the ManageEngine Security Advisory CVE-2026-74849 for vendor-authored technical details.

Detection Methods for CVE-2026-74849

Indicators of Compromise

Unexpected child processes (for example cmd.exe, powershell.exe, wscript.exe) spawned by the ADSelfService Plus GINA client process on Windows endpoints.
Outbound network connections from the GINA client host to unfamiliar or non-corporate destinations shortly after logon-screen activity.
New scheduled tasks, services, or local accounts created on endpoints running the ADSelfService Plus GINA integration.

Detection Strategies

Hunt for process-lineage anomalies where the ADSelfService Plus client binary spawns command interpreters or LOLBins.
Correlate authentication-adjacent events with subsequent file writes to %ProgramData%, %TEMP%, or %SystemRoot%\Tasks.
Alert on inbound network traffic to ADSelfService Plus endpoints from hosts that are not administrative jump boxes.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on all ADSelfService Plus GINA hosts.
Forward Sysmon Event IDs 1 (process create) and 3 (network connect) from GINA-enrolled endpoints to your SIEM.
Track ADSelfService Plus server access logs for anomalous request patterns targeting GINA-related endpoints.

How to Mitigate CVE-2026-74849

Immediate Actions Required

Upgrade ManageEngine ADSelfService Plus to build 7001 or later on both the central server and all enrolled endpoints.
Inventory Windows endpoints running the ADSelfService Plus GINA client and confirm the deployed build version.
Restrict network exposure of the ADSelfService Plus service so that only required internal networks can reach it.

Patch Information

Zohocorp addresses CVE-2026-74849 in ADSelfService Plus build 7001. Administrators should download and apply the upgrade from the vendor per the ManageEngine Security Advisory CVE-2026-74849. Endpoint GINA client packages must be updated in addition to the server component to remediate the vulnerable code path on workstations.

Workarounds

Segment ADSelfService Plus hosts behind firewall rules that limit access to authorized administrative subnets until patching is complete.
Temporarily disable the GINA client on endpoints where password self-service is not operationally required.
Monitor and block untrusted outbound connections originating from endpoints that host the GINA client.

bash

# Example firewall restriction (Windows) limiting inbound access to the ADSelfService Plus service
# Replace the port and remote subnet with values that match your environment
New-NetFirewallRule -DisplayName "Restrict ADSelfService Plus" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9251 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow