Reported by 5 outlets
A critical ManageEngine ADSelfService Plus vulnerability (CVE-2026-74849) allows system compromise. Update to build 7001 to secure your endp
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.03 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-74849 is a pre-authentication code execution flaw in the GINA client of ManageEngine ADSelfService Plus, the component that paints the self-service password reset and account unlock portal onto the Windows logon screen through an embedded kiosk browser. An unauthenticated attacker who can reach the logon screen abuses a weakness in that browser's error handling to execute code as NT AUTHORITY\SYSTEM, the highest local principal on Windows. Builds 7000 and earlier are affected and the flaw scores CVSS 9.8. Zoho fixed it in build 7001, dated August 21, 2026 in the release notes and marked fixed on August 24 in the advisory, by removing an unused navigation action and trapping unhandled client-side errors globally. Marouane Belabbassi and Amjad E Alhejaili reported it through the Zoho BugBounty program.
The tempting read, that a logon-screen bug needs physical access and is therefore niche, understates the exposure. SecurityOnline's reporting describes the prerequisite as physical or remote access to the logon screen, and a remote desktop session presents a logon screen too, which is precisely the ambiguity that must be resolved before exposure can be sized; the GBHackers account says physical access and the advisory says only access to the logon screen. The stronger argument for urgency is the patch math: build 7001 also closed a SAML XML Signature Wrapping bypass that let a low-privileged SSO user authenticate as super-administrator, a replayable 30-second TOTP window, and an unauthenticated REST API authorization bypass. A fleet still on 7000 is not carrying one critical bug, it is carrying a stack of them, and the server side of those needs no console access at all. Noise is high: a re-share in this story's own timeline claimed no patch existed while recommending build 7001.
Inventory first: the product's GINA/macOS/Linux installation report enumerates exactly which endpoints carry the vulnerable component, and only those hosts are exposed to this vector, since web-portal-only deployments do not render a logon-screen browser. Upgrade the server to build 7001 or later via the service pack, noting 7001 supports only 64-bit installations, so 32-bit hosts must migrate first. On endpoints that cannot patch quickly, the only workaround on record is removing the GINA client, the right trade for kiosks, shared terminals, and machines in uncontrolled physical space. ADSelfService Plus can forward its audit logs to syslog, and because the exploited browser runs as SYSTEM before any user session exists, process launches attributable to the logon-screen browser on GINA hosts are the signal to pull from endpoint logs for pre-patch periods.
Two developments would move this assessment. A KEV listing or credible exploitation telemetry would convert a patch-hygiene story into a compromise hunt, and EPSS at 4.6 percent with no public proof-of-concept as of September 22 means that flip is plausible, not hypothetical. A vendor or researcher statement on remote reachability, RDP in particular, would resize the exposed population overnight in either direction, since the sources currently disagree between physical and physical-or-remote access.
Timeline
-
original reporting
A critical ManageEngine ADSelfService Plus vulnerability (CVE-2026-74849) allows system compromise. Update to build 7001 to secure your endp
securityonline.info · 21d ago · September 22nd, 2026
A critical ManageEngine ADSelfService Plus vulnerability (CVE-2026-74849) allows system compromise. Update to build 7001 to secure your endp
via Mastodon https://securityonline.info/manageengine-adselfservice-plus-vulnerability-cve-2026-74849/?utm_source=mastodon&utm_medium=jetpack_social
-
update from manageengine.com
ADSelfService Plus Release Notes, Build 7001
manageengine.com · 54d ago · August 21st, 2026
The vendor release notes date build 7001 to August 21, 2026 and describe the Logon Agent fix as removing an unused navigation action and trapping unhandled client-side errors globally, closing an RCE and privilege escalation path that allowed any user to reach SYSTEM from the locked screen. The same build also bundles an XML Signature Wrapping authentication bypass in SAML SSO allowing a low-privileged SSO user to authenticate as super-administrator, a TOTP replay fix, an unauthenticated REST API authorization bypass fix, and a path traversal fix. Build 7001 additionally discontinues 32-bit installations and removes TLS 1.0 and 1.1 support, which creates upgrade friction for legacy fleets.
-
update from manageengine.com
CVE-2026-74849 | Remote code execution vulnerability in ADSelfService Plus GINA client
manageengine.com · 51d ago · August 24th, 2026
The Zoho/ManageEngine advisory lists ADSelfService Plus builds 7000 and below as affected and build 7001 as the fix, with a stated fixed-on date of August 24, 2026, one month before the story's first_seen. It describes an unauthenticated attacker with access to the Windows logon screen executing code in the NT AUTHORITY\SYSTEM context through the GINA client's embedded kiosk browser, and credits researchers Marouane Belabbassi and Amjad E Alhejaili through the Zoho BugBounty program. The page carries no publication timestamp of its own, so the date used here is the fixed-on date stated on the page.
-
update from www.valtersit.com
CVE-2026-74849 - Critical RCE in ManageEngine ADSelfService Plus GINA client. CVSS 9.8. Update to build 7001 immediately. # CVE # ManageEngi
www.valtersit.com · 21d ago · September 22nd, 2026
CVSS 9.8. Update to build 7001 immediately. # CVE # ManageEngi
via Mastodon https://www.valtersit.com/cve/CVE-2026-74849/
-
update from gbhackers.com
ManageEngine RCE Flaw Enables SYSTEM Code Execution From Windows Login Screen
gbhackers.com · 20d ago · September 23rd, 2026
ManageEngine has addressed a critical remote code execution vulnerability in ADSelfService Plus, which could allow an unauthenticated attacker to execute arbitrary code as NT AUTHORITY\SYSTEM from the Windows device’s logon screen. This vulnerability, identified as CVE-2026-74849, affects ADSelfService Plus builds 7000 and earlier that utilize the product’s GINA client. The issue lies within the GINA […] The post ManageEngine RCE Flaw Enables SYSTEM Code Execution From Windows Login Screen appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
ManageEngine ADSelfService Plus Flaw Lets Unauthenticated Attackers Execute Code as SYSTEM
cyberpress.org · 20d ago · September 23rd, 2026
Tracked as CVE-2026-74849, the flaw affects the product’s GINA client component, which integrates ADSelfService Plus password reset and account-unlock functions into the Windows logon experience. ManageEngine ADSelfService Plus Flaw The vulnerable GINA client presents the ADSelfService Plus self-service password reset and account unlock portal directly on the Windows sign-in screen. It uses an embedded kiosk browser to enable users to access those recovery capabilities before authenticating to Windows. According to ManageEngine , CVE-2026-74849 stems from a security issue involving the embedded browser’s error handling. An attacker who can access the Windows logon screen may be able to abuse the browser environment to execute code on the local endpoint. Because the GINA client operates in the SYSTEM context, successful exploitation does not merely provide access under a normal local user account. This level of access could enable an attacker to fully compromise an affected device, including creating privileged acc
-
mentioned by www.valtersit.com
CVE-2026-74849 ManageEngine ADSelfService Plus RCE, CVSS 9.8, no patch yet. Update to build 7001 or later now. https://www. valtersit.com/cv
www.valtersit.com · 13d ago · September 30th, 2026