Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login Screen
Critical CVE-2026-74849 in ManageEngine ADSelfService Plus lets unauthenticated attackers execute SYSTEM code via the Windows login screen.
ManageEngine has patched a critical remote code execution vulnerability (CVE-2026-74849) in ADSelfService Plus with a CVSS score of 9.8. The flaw exists in the GINA client, which presents password reset functions on the Windows login screen, and allows an unauthenticated attacker to execute arbitrary commands as the SYSTEM user. The vulnerability is caused by OS command injection (CWE-78) and was fixed in build 7001 released on August 24, 2026.
- Critical RCE vulnerability (CVE-2026-74849) in ManageEngine ADSelfService Plus.
- Allows unauthenticated attackers to execute code as SYSTEM via the Windows login screen.
- Affects builds 7000 and earlier; fixed in build 7001 released August 24, 2026.
- Root cause is OS command injection in the GINA client component.
- CVEs
- CVE-2026-74849
- Tags
- adselfservice-pluscommand-injectioncritical-vulnerabilitygina-clientmanageengineremote-code-executionwindows
- Products
- ADSelfService Plus
- Organizations
- ZohoManageEngine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74849 | Unauthenticated OS Command Injection RCE in ManageEngine ADSelfService Plus GINA Client | 9.8 | — |
From the original article
2 min read at cybersecuritynews.com
ManageEngine has fixed a critical remote code execution vulnerability in ADSelfService Plus that could allow an unauthenticated attacker to run code as NT AUTHORITY\SYSTEM through a Windows device’s login screen. The flaw, tracked as CVE-2026-74849, affects the product’s GINA client in builds 7000 and earlier. Organizations should upgrade to build 7001 or later immediately.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.