CVE-2026-2740
Awaiting Analysis Awaiting Analysis - Queue
Authenticated Remote Code Execution in Zohocorp ManageEngine Products

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: ManageEngine

Description
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-06-10
AI Q&A
2026-05-21
EPSS Evaluated
2026-06-09
NVD
CVE-2026-2740
EUVD
EUVD-2026-31283
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
zohocorp manageengine_adselfservice_plus to 6525 (exc)
zohocorp datasecurity_plus to 6264 (exc)
zohocorp recoverymanager_plus to 6313 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-2740 is a high-severity authenticated remote code execution (RCE) vulnerability affecting ManageEngine ADSelfService Plus, RecoveryManager Plus, and DataSecurity Plus.

The flaw allows authenticated domain users to exploit improper access controls in the service used to deploy agents on client machines, enabling arbitrary command execution on those machines.

It affects ADSelfService Plus versions 6524 and earlier, DataSecurity Plus versions 6263 and earlier, and RecoveryManager Plus versions 6312 and earlier.

Impact Analysis

This vulnerability allows authenticated users to execute arbitrary commands remotely on agent machines, which can lead to unauthorized control over those systems.

Such unauthorized command execution can compromise the confidentiality, integrity, and availability of affected systems and data.

Mitigation Strategies

To mitigate this vulnerability, users should update to the fixed versions of the affected products.

  • Update ManageEngine ADSelfService Plus to Build 6525 or later.
  • Update DataSecurity Plus to Build 6264 or later.
  • Update RecoveryManager Plus to Build 6313 or later.

Users can download the latest service packs from ManageEngine’s official links and contact product support for assistance if needed.

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart