Remote Code Execution in Zohocorp ManageEngine ADSelfService Plus

Executive Summary

CVE-2026-74849 is a high-severity remote code execution vulnerability in Zohocorp ManageEngine ADSelfService Plus affecting builds 7000 and below. It exists in the embedded browser used by the self-service password reset and account unlock portal on the Windows logon screen. An attacker with access to the logon screen can exploit this to run arbitrary code with SYSTEM privileges, potentially taking full control of the affected system.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of ADSelfService Plus. If it is build 7000 or below, the system is vulnerable. Commands to check: For Windows, navigate to the installation directory and check the version in the product properties or use PowerShell: Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*ADSelfService Plus*"}

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with physical or logical access to the Windows logon screen to execute malicious code with SYSTEM-level permissions. This could lead to complete system compromise, unauthorized data access, installation of malware, or lateral movement within a network. Systems running vulnerable versions are at high risk if exposed to such attackers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution in the SYSTEM context, potentially exposing sensitive data. For GDPR, it may result in unauthorized access to personal data, violating confidentiality requirements. For HIPAA, it could compromise protected health information if exploited on systems handling such data.

Useful 0 Not Useful 0

Mitigation Strategies

Update ADSelfService Plus to build 7001 or later immediately. This version includes fixes for the vulnerability by improving error handling and hardening the embedded browser. Ensure no unauthorized access is possible at the Windows logon screen during the update process.

Useful 0 Not Useful 0