ManageEngine RCE Flaw Enables SYSTEM Code Execution From Windows Login Screen
Critical RCE flaw in ManageEngine ADSelfService Plus allows unauthenticated SYSTEM-level code execution from the Windows logon screen, requiring physical access.
ManageEngine has patched a critical remote code execution vulnerability, CVE-2026-74849, in its ADSelfService Plus software. The flaw, with a CVSS score of 9.8, allows an unauthenticated attacker with physical access to a Windows device's logon screen to execute arbitrary code as the highly privileged NT AUTHORITY\SYSTEM user. The vulnerability exists in the GINA client component used for self-service password resets. Organizations are urged to update to build 7001 or later and restrict physical access to affected endpoints.
- ManageEngine ADSelfService Plus has a critical RCE vulnerability (CVE-2026-74849) with a CVSS score of 9.8.
- The flaw allows unauthenticated attackers to execute code as NT AUTHORITY\SYSTEM from the Windows logon screen.
- Exploitation requires physical access to the device's login screen.
- The vulnerability affects versions before build 7001 and is patched in the latest update.
- CVEs
- CVE-2026-74849
- Vendors
- ManageEngine
- Products
- ADSelfService Plus
- Organizations
- ManageEngineZoho
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74849 | Unauthenticated OS Command Injection RCE in ManageEngine ADSelfService Plus GINA Client | 9.8 | — |
From the original article
2 min read at gbhackers.com
ManageEngine has addressed a critical remote code execution vulnerability in ADSelfService Plus, which could allow an unauthenticated attacker to execute arbitrary code as NT AUTHORITY\SYSTEM from the Windows device’s logon screen. This vulnerability, identified as CVE-2026-74849, affects ADSelfService Plus builds 7000 and earlier that utilize the product’s GINA client. The issue lies within the GINA […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.