CVE-2026-75791 – Zoho ManageEngine ADSelfService Plus
“When the password reset portal opens the door for attackers, every identity in the domain is at stake.”
Zohocorp has released build 7001 of ManageEngine ADSelfService Plus to fix two serious vulnerabilities in its self-service password management platform. CVE-2026-74849 has a CVSS score of 9.8, Critical severity. It is an OS command injection flaw in the GINA client that lets attackers execute code remotely. CVE-2026-75791 has a CVSS score of 8.6, High severity. It is an authentication bypass in the REST API caused by missing authentication on a critical function, and it allows elevation of privilege.
ADSelfService Plus connects directly to Active Directory, which makes it a high-value target. A successful attack can expose user credentials, account controls, and the wider domain. Every version before build 7001 is affected, so organizations should upgrade the same day.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-306