ManageEngine RCE Flaw Enables SYSTEM Code Execution From Windows Login Screen

ManageEngine has addressed a critical remote code execution vulnerability in ADSelfService Plus, which could allow an unauthenticated attacker to execute arbitrary code as NT AUTHORITY\SYSTEM from the Windows device’s logon screen.

This vulnerability, identified as CVE-2026-74849, affects ADSelfService Plus builds 7000 and earlier that utilize the product’s GINA client.

The issue lies within the GINA client, a component that enables self-service password reset and account unlock features directly on the Windows logon screen. The client provides these features through an embedded kiosk-style browser, creating an exposed pre-authentication interface on managed Windows endpoints.

ManageEngine RCE Flaw

According to ManageEngine, an attacker with access to a vulnerable Windows logon screen could exploit a security issue in the embedded browser, potentially allowing them to execute code in the NT AUTHORITY\SYSTEM context.

Because SYSTEM is the most privileged local security context in Windows, successful exploitation could fully compromise the affected device, including the ability to install malware, alter security settings, access local data, and establish persistence.

Public CVE records classify this issue as a critical vulnerability with a CVSS v3.1 score of 9.8, utilizing the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

This scoring indicates that the attack has low complexity, requires no attacker privileges or user interaction, and poses a significant risk to confidentiality, integrity, and availability. While the vendor advisory classifies the issue as “High,” the published CVE and NVD records assign it a critical severity score of 9.8.

The vulnerability affects ManageEngine ADSelfService Plus versions before build 7001, released on August 24, 2026. This update addresses the issue by correcting application error handling and strengthening the embedded browser used on the Windows logon screen.

This flaw is particularly concerning because it targets a pre-login component designed to help users recover their credentials or unlock accounts. Organizations typically deploy such tools broadly across employee endpoints, making asset discovery and patch verification crucial.

The vendor advisory explicitly notes that physical access to the device’s login screen is a prerequisite for exploitation. However, defenders should also evaluate how their GINA-client configuration, endpoint exposure, kiosk controls, remote access workflows, and network segmentation may influence practical attack paths.

• Identify endpoints running the ADSelfService Plus GINA client.
• Confirm whether the installed version of ADSelfService Plus is 7000 or earlier.
• Upgrade immediately to ADSelfService Plus build 7001 or later through ManageEngine’s service-pack process.
• Restrict untrusted physical access to Windows systems until affected endpoints are patched.
• Review endpoint telemetry for unexpected processes or command executions associated with logon-screen activity.
• Validate that the GINA-client browser is updated and that the remediated configuration is deployed consistently across managed devices.

ManageEngine acknowledges Marouane Belabbassi and Amjad E Alhejaili for reporting the vulnerability through the Zoho BugBounty program.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC