CVE-2026-2740CWE-77

Remote Code Execution

High · published May 21, 2026

CVSS v3.1
8.4
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.04011 · 90.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-05-21T12:36Z
EPSS history
Timeline
  • 21 MAY 12:36Z
    Remote Code Execution
    cvelistv5