PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2740 Zohocorp CVE debrief

CVE-2026-2740 is a high-severity authenticated remote code execution issue affecting ManageEngine ADSelfService Plus before 6525, DataSecurity Plus before 6264, and RecoveryManager Plus before 6313. The supplied NVD record rates it 8.4 and maps it to CWE-77, with a CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L, indicating network-reachable impact that requires authenticated access and high attack complexity.

Vendor
Zohocorp
Product
ManageEngine ADSelfService Plus
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators and security teams responsible for ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus deployments, especially where authenticated users can reach the affected agent workflows or agent machines.

Technical summary

The source corpus describes an authenticated remote code execution flaw in the agent machines for affected ManageEngine products, attributed to a bug in a third-party dependency. NVD associates the issue with CWE-77 and records a CVSS 3.1 score of 8.4 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L). Based on the supplied data, the vulnerable versions are ADSelfService Plus prior to 6525, DataSecurity Plus prior to 6264, and RecoveryManager Plus prior to 6313.

Defensive priority

High. Authenticated RCE on agent machines can enable code execution on managed hosts, and the supplied CVSS score indicates substantial confidentiality and integrity impact.

Recommended defensive actions

  • Upgrade ManageEngine ADSelfService Plus to version 6525 or later.
  • Upgrade ManageEngine DataSecurity Plus to version 6264 or later.
  • Upgrade ManageEngine RecoveryManager Plus to version 6313 or later.
  • Review exposure of agent-machine functionality to authenticated users and restrict access to only required administrators and service accounts.
  • Monitor affected hosts for unexpected command execution, new processes, unusual agent behavior, and unauthorized configuration changes.
  • Follow the linked ManageEngine advisory for product-specific remediation guidance and any interim mitigation steps.

Evidence notes

All claims in this debrief are limited to the supplied CVE description, the NVD metadata snapshot, and the referenced ManageEngine advisory link. The source package provides no exploit details, no KEV entry, and no additional vendor guidance beyond the advisory reference. Vendor attribution in the supplied enrichment is low-confidence and marked for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2740 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2740

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2740 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2740

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-2740.html

    0fc0942c-577d-436f-ae8e-945763c79b02

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.