CVE-2026-74849

Zohocorp ManageEngine ADSelfService Plus builds before 7001 contain a remote code execution flaw, classified as OS command injection (CWE-78), in the GINA client component that provides Windows logon-screen self-service password reset and account unlock. The CVSS 3.1 score of 9.8 (network vector, low attack complexity, no privileges or user interaction required) indicates an unauthenticated remote attacker can exploit it over the network and fully compromise confidentiality, integrity, and availability of the affected machine. Organizations running older builds of ADSelfService Plus, especially those that have rolled the GINA client out to domain-joined Windows machines, are affected. There is no known public proof of concept, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported to date, but ManageEngine products have historically been targeted quickly once details circulate.

What to do: Upgrade ADSelfService Plus to build 7001 or later immediately, making sure GINA client installations on endpoints are updated as well as the server. Restrict the ADSelfService Plus server to internal/VPN access rather than direct internet exposure, and limit the machines running the GINA client to those that need it. Review server and endpoint logs for unexpected child processes or command execution associated with the GINA client component, and rotate credentials on any machine where suspicious activity is found.