CVE-2026-74849: 
Zoho ManageEngine ADSelfService Plus vulnerability analysis and mitigation

CVE-2026-74849 is a remote code execution (RCE) vulnerability in the GINA client component of Zohocorp ManageEngine ADSelfService Plus. The flaw exists in the embedded (kiosk) browser presented on the Windows logon screen, allowing an unauthenticated attacker with physical or remote access to the logon screen to execute arbitrary code in the NT AUTHORITY\SYSTEM context. All builds prior to build 7001 are affected; the issue was fixed on August 24, 2026, and publicly disclosed on September 22, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (ManageEngine Advisory, GitHub Advisory).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection). The GINA client in ADSelfService Plus embeds a browser on the Windows logon screen to provide self-service password reset and account unlock functionality; a flaw in the application's error handling within this embedded browser allows an attacker to inject and execute OS-level commands. Because the GINA component runs in the SYSTEM context prior to user authentication, exploitation requires no privileges and no user interaction — only access to the Windows logon screen. The vendor resolved the issue in build 7001 by correcting error handling and hardening the embedded logon-screen browser (ManageEngine Advisory, GitHub Advisory).

Successful exploitation grants an unauthenticated attacker full SYSTEM-level code execution on the affected Windows host before any user logs in, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can install malware, create backdoor accounts, exfiltrate credentials or sensitive data, and use the compromised host as a pivot point for lateral movement within the network. Because the GINA component is exposed at the Windows logon screen, this vulnerability is particularly dangerous on domain-joined machines and Remote Desktop Protocol (RDP)-accessible endpoints (ManageEngine Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation (Feedly). The EPSS score is approximately 4.61% (91st percentile), indicating a relatively elevated probability of exploitation within 30 days compared to most CVEs (GitHub Advisory). The vulnerability is marked as automatable by NVD SSVC analysis, meaning exploitation could be scripted at scale. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has published a detection (ID 532664) for this vulnerability.

1. Reconnaissance: Identify Windows systems with ManageEngine ADSelfService Plus GINA client installed (builds 7000 and below) that are accessible via physical access or RDP, using network scanning tools or Shodan/Censys for exposed RDP endpoints.
2. Access the Windows logon screen: Connect to the target system via RDP or gain physical access to reach the Windows logon screen where the ADSelfService Plus GINA portal (embedded kiosk browser) is displayed.
3. Interact with the embedded browser: Trigger an error condition or navigate within the embedded browser on the logon screen to reach a state where the application's error handling is invoked.
4. Inject OS command payload: Exploit the improper neutralization of special elements (CWE-78) in the embedded browser's error handling to inject a crafted OS command payload (e.g., launching cmd.exe or powershell.exe).
5. Achieve SYSTEM-level code execution: The injected command executes in the NT AUTHORITY\SYSTEM context, granting full control of the host — enabling creation of admin accounts, deployment of malware, or further lateral movement (ManageEngine Advisory).

• Process: Unexpected child processes spawned from the ADSelfService Plus GINA/browser process prior to user logon (e.g., cmd.exe, powershell.exe, net.exe) running as NT AUTHORITY\SYSTEM.
• Logs: Windows Security Event Log entries showing new local administrator account creation or privilege escalation events at or around the time of logon screen activity; Application event log errors from the ADSelfService Plus GINA component.
• Network: Outbound network connections from the Windows logon session (before user authentication) to unexpected external IP addresses or internal hosts, potentially indicating reverse shell or C2 activity.
• File System: New or modified files in system directories (e.g., C:\Windows\System32, C:\Windows\Temp) created by the SYSTEM account during logon screen activity; presence of unauthorized scheduled tasks or services created by SYSTEM.
• Registry: New registry run keys or services added under SYSTEM context around the time of exploitation.

The primary remediation is to update ManageEngine ADSelfService Plus to build 7001 or later, which corrects the error handling and hardens the embedded logon-screen browser (ManageEngine Advisory). If immediate patching is not feasible, organizations should restrict physical and network access to systems running the GINA client, particularly limiting RDP exposure to only trusted networks or VPN-gated access. Additionally, monitoring for anomalous SYSTEM-level process activity at the Windows logon screen can help detect exploitation attempts. The Western Australian Government SOC has also issued an advisory recommending urgent patching (WA SOC Advisory).

Multiple cybersecurity news outlets covered the vulnerability, including CyberSecurityNews, GBHackers, and CyberPress, highlighting the risk of attackers gaining SYSTEM access through the Windows login screen (CyberSecurityNews, GBHackers). The Western Australian Government SOC issued a formal advisory urging organizations to patch immediately (WA SOC Advisory). The Hacker News included it in a weekly security recap, and social media discussion on Mastodon and Infosec.exchange noted the severity of pre-authentication SYSTEM-level access. Qualys published a detection plugin (ID 532664) and included it in their September 2026 application security detections roundup.