CVE-2026-2740highCWE-77

CVE-2026-2740: high-severity vulnerability in Zohocorp ManageEngine ADSelfService Plus

Remote Code Execution

Published · Updated

Follow this CVE+ Monitor ManageEngine ADSelfService Plus+ Monitor ManageEngine DataSecurity Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 1.7%
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
Zohocorp · ManageEngine ADSelfService PlusZohocorp · ManageEngine DataSecurity PlusZohocorp · ManageEngine RecoveryManager Plus
Related CVEs — Zohocorp ManageEngine ADSelfService Plus

In the same product, most dangerous first.

CVE-2026-1367HIGHSQL InjectionEPSS 8.6%CVE-2026-74849CRITICALRemote code execution vulnerabilityEPSS 4.6%CVE-2026-18912HIGHCVE-2026-18912EPSS 2.8%CVE-2026-18911HIGHCVE-2026-18911EPSS 1.9%CVE-2026-75791HIGHAuthentication bypass vulnerabilityEPSS 1.8%CVE-2025-11250CRITICALAuthentication BypassEPSS 1.6%