Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code…

CVE-2026-74849 is an OS command injection (CWE-78) in the ManageEngine ADSelfService Plus GINA/Credential Provider client — the agent installed on every domain-joined Windows endpoint to enable self-service password reset from the logon screen. All builds prior to 7001 are affected. The agent runs as NT AUTHORITY\SYSTEM and communicates with the ADSelfService Plus server over HTTP (port 8888) by default. An unauthenticated attacker who can reach the agent on the network can inject OS commands that execute with full SYSTEM privileges. Because the agent is typically pushed to every workstation via GPO or SCCM, a successful exploit could be repeated across thousands of endpoints in minutes.

Zoho rates this CRITICAL 9.8 with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, treating it as a zero-click, unauthenticated, network-accessible RCE. That vector is *technically* accurate — the GINA agent does accept network input without authentication. But it overstates the real-world risk because GINA clients sit on internal workstation endpoints, not internet-facing servers. An attacker must already be on the corporate LAN or have compromised an adjacent system to reach them. There is no public PoC, no KEV listing, and no confirmed in-the-wild exploitation as of disclosure day. The realistic severity is HIGH (8.4): still dangerous due to fleet-scale SYSTEM access once inside, but not the internet-facing zero-click emergency that 9.8 implies.

1. Enforce HTTPS with certificate validation on all GINA agent communications — Switch the GINA agent from default HTTP to HTTPS immediately. In the ADSelfService Plus admin console, navigate to Admin → Product Settings → Connection, enable HTTPS on port 9251, and push the updated configuration to all agents. This eliminates unauthenticated plaintext command injection via the agent channel. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity.
2. Restrict inbound access to GINA agent ports via Windows Firewall GPO — Create a GPO-enforced Windows Firewall rule on all endpoints blocking inbound connections to the GINA agent port (default 8888/9251) from all sources except the ADSelfService Plus server IP(s). This limits the attack surface to an attacker who has already compromised the management server. Deploy within 30 days per the noisgate mitigation SLA.
3. Update ADSelfService Plus server and agents to build 7001 — Apply the vendor patch: update the server to build 7001 first, then trigger the GINA agent auto-update or push the updated agent via SCCM/GPO. Verify agent versions via the Reports → GINA/Mac/Linux Reports → Agent Installed Machines report. Complete within 180 days per the noisgate remediation SLA for HIGH severity.
4. Deploy EDR process-tree monitoring for GINA agent child processes — Create an EDR detection rule alerting on any child process (especially cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by the ADSelfService Plus GINA agent service process. This provides post-exploitation detection even if the injection succeeds. Implement immediately as a detection-in-depth measure.
5. Audit and exempt privileged workstations from GINA agent deployment — Review your GPO scope and remove the GINA/CP agent from PAWs, jump servers, and any Tier 0/Tier 1 admin workstations. These machines should not have self-service password reset from the logon screen — the blast radius of SYSTEM compromise on a privileged workstation is domain-scale. Implement within 30 days.

Run this script on each target Windows endpoint (or push it fleet-wide via SCCM/Intune/GPO startup script). Requires local administrator privileges. Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-74849.ps1

#Requires -Version 5.1
<#
.SYNOPSIS
    CVE-2026-74849 - ManageEngine ADSelfService Plus GINA Client RCE Check
.DESCRIPTION
    Detects the ADSelfService Plus GINA/CP agent and checks whether the
    installed build is vulnerable (< 7001).
.OUTPUTS
    VULNERABLE | PATCHED | UNKNOWN
.NOTES
    Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN (not installed or
    version indeterminate)
#>

$VulnBuild = 7001
$Found = $false
$BuildNum = $null

# --- Registry detection (primary) ---
$RegPaths = @(
    'HKLM:\SOFTWARE\WOW6432Node\ZOHO Corp\ADSelfService Plus Client Software',
    'HKLM:\SOFTWARE\ZOHO Corp\ADSelfService Plus Client Software'
)
foreach ($rp in $RegPaths) {
    if (Test-Path $rp) {
        $Found = $true
        $props = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
        foreach ($key in @('BuildNumber','Version','ProductVersion','AgentVersion')) {
            if ($props.PSObject.Properties[$key] -and $props.$key) {
                $BuildNum = $props.$key
                break
            }
        }
        break
    }
}

# --- File-system fallback ---
if (-not $Found) {
    $AgentDirs = @(
        "$env:ProgramFiles\ManageEngine\ADSelfService Plus Client Software",
        "${env:ProgramFiles(x86)}\ManageEngine\ADSelfService Plus Client Software",
        'C:\ManageEngine\ADSelfService Plus Client Software'
    )
    foreach ($dir in $AgentDirs) {
        if (Test-Path $dir) {
            $Found = $true
            $dll = Get-ChildItem -Path $dir -Include '*.dll','*.exe' -Recurse -ErrorAction SilentlyContinue |
                   Where-Object { $_.VersionInfo.ProductName -match 'ADSelfService|ManageEngine' } |
                   Select-Object -First 1
            if ($dll) {
                $ver = $dll.VersionInfo.ProductVersion
                if ($ver -match '(\d{4,})') { $BuildNum = $Matches[1] }
            }
            break
        }
    }
}

# --- Credential Provider CLSID fallback ---
if (-not $Found) {
    $cpRoot = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers'
    if (Test-Path $cpRoot) {
        Get-ChildItem $cpRoot -ErrorAction SilentlyContinue | ForEach-Object {
            $val = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).'(default)'
            if ($val -match 'ADSelfService|ManageEngine|ZOHO') { $Found = $true }
        }
    }
}

# --- Verdict ---
if (-not $Found) {
    Write-Output 'UNKNOWN - ADSelfService Plus GINA/CP client not detected.'
    exit 2
}
if (-not $BuildNum) {
    Write-Output 'UNKNOWN - Agent detected but build number indeterminate. Verify manually.'
    exit 2
}

$ParsedBuild = 0
if ([int]::TryParse(($BuildNum -replace '[^0-9]',''), [ref]$ParsedBuild)) {
    if ($ParsedBuild -lt $VulnBuild) {
        Write-Output "VULNERABLE - Build $ParsedBuild is below patched build $VulnBuild (CVE-2026-74849)."
        exit 1
    } else {
        Write-Output "PATCHED - Build $ParsedBuild meets or exceeds patched build $VulnBuild."
        exit 0
    }
} else {
    Write-Output "UNKNOWN - Could not parse build value '$BuildNum'. Verify manually."
    exit 2
}

1. CVE-2026-74849 — OffSeq Threat Radar
2. CVE-2026-74849 — Strix.ai
3. CVE-2026-74849 — TheHackerWire
4. ManageEngine ADSelfService Plus Security Advisories
5. CISA AA21-259a — APT Actors Exploiting ManageEngine ADSelfService Plus
6. Pedro Ribeiro — ADSelfService Plus GINA Client PoC (historical)
7. ManageEngine GINA/CP Architecture Documentation
8. CVE-2026-74849 — ThreatInt