CVE-2026-74849CWE-78command-injection

CVE-2026-74849

Critical · published September 22, 2026

CVSS v3.1
9.8
EPSS
5%
Percentile
91.6
In the wild
Unconfirmed
What it is

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04606 · 91.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-22T16:17Z
References (1)
https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html · 0fc0942c-577d-436f-ae8e-945763c79b02
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 4%
    epss
  • 22 SEP 11:55Z
    Remote code execution vulnerability
    cvelistv5