# CVE-2026-74849

RCE in ManageEngine ADSelfService Plus GINA client (pre-build 7001)

- Page: https://www.vulneraibility.com/cve/CVE-2026-74849
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 4.61% (percentile 91.7)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-78
- Published: 2026-09-22

## Affected versions

- Zohocorp ManageEngine ADSelfService Plus: affected < 7001

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution on Windows endpoints via GINA client; attackers can run commands, deploy malware, and potentially compromise AD/domain.

## Action

Immediate action required

## Recommendation

Upgrade to build 7001+ and deploy the patched GINA client; isolate affected endpoints until patched.

## References

- [other] https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.