What is the CVSS score of CVE-2026-2740?

CVE-2026-2740 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 1.2%.

Which versions of ManageEngine ADSelfService Plus are affected by CVE-2026-2740?

Three Zoho ManageEngine products (ADSelfService Plus, DataSecurity Plus, RecoveryManager Plus) contain a high-severity vulnerability enabling authenticated attackers with low privileges to execute…. A patch is available.

How to fix or mitigate CVE-2026-2740?

Within 24 hours: Identify all Zoho ManageEngine deployments and current versions; restrict administrative access to trusted networks only. Within 7 days: Deploy patches to ADSelfService Plus (build 6525 or later), DataSecurity Plus (6264 or later), and RecoveryManager Plus (6313 or later) after testing in non-production. Within 30 days: Review authenticated session and command execution logs from the past 90 days on affected systems to verify no unauthorized activity occurred.

ManageEngine ADSelfService Plus CVE-2026-2740

EUVD-2026-31283 HIGH

Command Injection (CWE-77)

2026-05-21 Zohocorp

GHSA-hrrx-gqw9-2hrq

RCE Zoho Command Injection

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 14:18 vuln.today

Patch available

May 21, 2026 - 14:02 EUVD

DescriptionCVE.org

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

AnalysisAI

Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis.

Technical ContextAI

ManageEngine ADSelfService Plus is an identity and self-service password management platform deployed in enterprise Active Directory environments; DataSecurity Plus provides file auditing and data discovery, while RecoveryManager Plus performs AD/Microsoft 365 backup and recovery. All three products deploy lightweight agents to managed endpoints to gather telemetry or enforce policy. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), confirmed by the 'Command Injection' tag, located in a third-party dependency shared across these Zoho products. The CPE strings (cpe:2.3:a:zohocorp:manageengine_adselfservice_plus, manageengine_datasecurity_plus, manageengine_recoverymanager_plus) confirm the bug spans all three product families through the same shared component, and the impact is on the agent machines rather than the central server.

RemediationAI

Vendor-released patches are available: upgrade ManageEngine ADSelfService Plus to build 6525 or later, DataSecurity Plus to build 6264 or later, and RecoveryManager Plus to build 6313 or later, following the vendor advisory at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-2740.html. Because the flaw lives in the deployed agent, ensure that not only the server console is patched but that all rolled-out agent binaries are updated on every managed endpoint, since a partially patched fleet remains exposed. As a compensating control until patching completes, restrict network reachability to agent listening services using host firewall rules so that only the management server can talk to agents (this will not break normal product operation), and tighten the privilege of accounts that can authenticate to the management console, since the bug requires PR:L. Avoid disabling the agent entirely as a workaround unless absolutely necessary, since doing so removes password self-service, auditing, or backup coverage for those endpoints.