CVE-2026-74849Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
10 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 7 signals
Technical details provided in 9 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 5d ago at 2 mentions (2026-09-22); latest day: 2
10 total mentions across 6 days

Deep dive

Activity timeline10 mentions / 6d

Signal classification3 categories

Patch

770.0%

Disclosure

220.0%

General

110.0%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	2	Disclosure1Patch1
2026-09-23	2	Patch2
2026-09-24	2	Disclosure1General1
2026-09-27	1	Patch1
2026-09-29	1	Patch1
2026-09-30	2	Patch2

Full discourse10 posts

Duty@duty_1g41d
Patch
Proud to share CVE-2026-74849, a Critical vulnerability I discovered in @manageengine ADSelfService Plus. Unauthenticated RCE as NT AUTHORITY\SYSTEM CVSS: 9.8 | CWE-78 Affected: all builds up to 7000 Fixed in: 7001 https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html #CyberSecurity #CVE #RCE #BugBounty https://t.co/l3bpozzFMo
Post summary
This tweet discloses CVE-2026-74849 as a critical unauthenticated RCE with technical details and CVSS 9.8, but primarily confirms remediation by stating it is 'Fixed in: 7001' and linking to the vendor advisory, classifying it as Patch per priority rules.
424295448.8K
1.2K followersView on X
CERT-PY@CERTpy46d
Disclosure
⚠️ Vulnerabilidades en productos ManageEngine ❗ CVE-2026-75791 ❗ CVE-2026-74849 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-manageengine-2/ https://t.co/usol6bFBRZ
Post summary
The tweet announces vulnerabilities in ManageEngine products by listing two CVEs and providing a link for more information. It lacks details on exploitation, remediation, or technical specifics.
01030317
6.7K followersView on X
📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中@MalwareBibleJP39d
Patch
ManageEngineのセルフサービス型パスワード管理製品で、Windowsのログオン画面から認証なしにSYSTEM権限でコードを実行されうる脆弱性が公表。識別番号はCVE-2026-74849です。ManageEngineによると、ログオン画面にパスワード再設定などの画面を表示するクライアントの組み込みブラウザが悪用され、攻撃が成立するとそのクライアントを導入した端末全体が侵害されるおそれがあります。修正版は8月公開のビルド7001。【要点の整理】・対象はADSelfService PlusのGINAクライアント。Windowsのログオン画面に、パスワード再設定とアカウントロック解除の画面を組み込みブラウザで表示する機能・影響はビルド7000以前。修正版のビルド7001では、エラー処理を修正し、組み込みブラウザを堅牢化。7001への更新用サービスパックは64ビット版にのみ適用でき、32ビット版は先に64ビット版への移行が必要・深刻度は、ManageEngineの勧告では「High」だが、CVE記録のCVSS 3.1基本値は9.8(Critical)で、攻撃元区分もネットワークとされ、両者の評価に差・ビルド7001のリリースノートには、ログオン用エージェントの脆弱性を含む9件のセキュリティ修正が並び、うち1件は認証なしでREST APIの認可の確認を回避し、管理者に限られた設定を読み書きできる脆弱性 ManageEngineはビルド7001以降への更新を案内しています。米CISAが公開する、悪用が確認された脆弱性のカタログ(KEV)には、9月28日時点で掲載はありません。詳細は以下を参照： https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html https://www.manageengine.com/products/self-service-password/release-notes.html (※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)
Post summary
The text details a critical vulnerability (CVE-2026-74849) in ManageEngine ADSelfService Plus GINA Client allowing unauthenticated SYSTEM code execution, and primarily conveys that a patch (Build 7001) is available with specific update instructions for 64-bit and 32-bit systems. No active exploitation or PoC is reported.
00020822
9.0K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters38d
Patch
CVE-2026-74849 ManageEngine ADSelfService Plus RCE, CVSS 9.8, no patch yet. Update to build 7001 or later now. https://www.valtersit.com/cve/CVE-2026-74849 #CVE #infosec #ManageEngine #ManageEngine #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet reports a high‑severity RCE vulnerability (CVSS 9.8) in ManageEngine ADSelfService Plus and advises updating to build 7001 or later as an immediate remediation.
0000053
1.1K followersView on X
iototsecnews@iototsecnews39d
Patch
ManageEngine の脆弱性 CVE-2026-74849 が FIX：Windows ログイン画面からの SYSTEM 権限でのコード実行 https://iototsecnews.jp/2026/09/23/critical-manageengine-flaw-lets-attackers-gain-system-access-through-windows-login-screen/ 訳者による紹介記事では、 ManageEngine ADSelfService Plus の GINA クライアントにおける深刻なリモート・コード実行の脆弱性である CVE-2026-74849 が取り上げられています。ログイン画面のブラウザ処理不備により、未認証の攻撃者が最高権限である SYSTEM 権限でコードを実行する問題の背景がありました。影響として対象システムの完全な掌握につながるおそれがあり、ビルド 7001 以降への迅速なアップデートの実施／エンドポイントのログ確認／アクセス制限の適用による対応が求められます。環境の安全性確保に向けて、パッチ適用が推奨されます。 #ADSelfServicePlus #CVE202674849 #ManageEngine #Vulnerability #Zoho
Post summary
The post highlights a critical RCE vulnerability in ManageEngine ADSelfService Plus and stresses the importance of patching to build 7001 or later, along with additional mitigation steps.
00000178
519 followersView on X
NotCVE@notCVE44d
General
🎯 Most likely to be exploited next (EPSS): • CVE-2026-74849 — EPSS 4.6% · CVSS 9.8 • CVE-2026-95675 — EPSS 3.9% · CVSS 9.8 • CVE-2026-76978 — EPSS 3.7% · CVSS 8.8 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-09-24.md
Post summary
The tweet lists three CVEs with high EPSS scores and CVSS ratings, highlighting them as likely future exploitation targets, but provides no PoC, exploit code, active exploitation evidence, or patch information.
0000039
75 followersView on X
Cybersecurity News DE@cybsecuritynews44d
Disclosure
#schwachstellen ManageEngine ADSelfService Plus: Kritische RCE-Lücke im GINA-Client vor Build 7001 #adselfserviceplus #cve202674849 #manageengine #zohocorp https://cybersecurity-news.de/manageengine-adselfservice-plus-cve-2026-74849-rce-build-7001
Post summary
The tweet announces a critical RCE vulnerability in ManageEngine ADSelfService Plus GINA client prior to Build 7001, without mentioning exploits, active use, or a patch.
0000044
15 followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
A severe RCE flaw in ManageEngine ADSelfService Plus (CVE-2026-74849) lets attackers execute code as SYSTEM straight from the Windows login screen — no credentials needed. This bug targets the GINA client in builds 7000 and earlier; a patch arrived in build 7001. If you manage ADSelfService Plus, update now, audit login-screen activity, and lock down exposure to mitigate risk. #ManageEngine #Cybersecurity #ADSelfService #RCE #WindowsSecurity #Vulnerability https://thedailytechfeed.com/critical-adselfservice-plus-bug-lets-hackers-elevate-to-system-via-windows-login/
Post summary
The text announces a severe RCE vulnerability in ManageEngine ADSelfService Plus (CVE-2026-74849) and highlights the availability of a patch in build 7001, urging immediate updates and mitigation steps.
0000053
760 followersView on X
NEXSIGHT@NEXSIGHTNEWS45d
Patch
ManageEngine ADSelfService PlusのGINAクライアントにSYSTEM権限を奪われるRCE脆弱性「CVE-2026-74849」、ビルド7001で修正 https://cyber.nexsight.co/articles/2026/09/23/manageengine-adselfservice-plus-cve-2026-74849-gina-rce-2026-09-23/
Post summary
The tweet reports that CVE-2026-74849 is an RCE vulnerability in ManageEngine ADSelfService Plus GINA client that has been patched in build 7001, with a link to further details.
0000063
75 followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
A critical ManageEngine ADSelfService Plus vulnerability (CVE-2026-74849) allows system compromise. Update to build 7001 to secure your endpoints. #ManageEngine #ADSelfServicePlus #CVE202674849 #Cybersecurity #Infosec #RCE https://securityonline.info/manageengine-adselfservice-plus-vulnerability-cve-2026-74849/
Post summary
The text announces a critical RCE vulnerability in ManageEngine ADSelfService Plus (CVE-2026-74849) and directs users to update to build 7001 as the primary remediation, with limited technical detail beyond severity and impact.
00000417
13.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-74849

Duty[verified]@duty_1gPatch

This tweet discloses CVE-2026-74849 as a critical unauthenticated RCE with technical details and CVSS 9.8, but primarily confirms remediation by stating it is 'Fixed in: 7001' and linking to the vendor advisory, classifying it as Patch per priority rules.

📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中[verified]@MalwareBibleJPPatch

The text details a critical vulnerability (CVE-2026-74849) in ManageEngine ADSelfService Plus GINA Client allowing unauthenticated SYSTEM code execution, and primarily conveys that a patch (Build 7001) is available with specific update instructions for 64-bit and 32-bit systems. No active exploitation or PoC is reported.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The tweet reports a high‑severity RCE vulnerability (CVSS 9.8) in ManageEngine ADSelfService Plus and advises updating to build 7001 or later as an immediate remediation.

The Daily Tech Feed[verified]@dailytechonxPatch

The text announces a severe RCE vulnerability in ManageEngine ADSelfService Plus (CVE-2026-74849) and highlights the availability of a patch in build 7001, urging immediate updates and mitigation steps.

CERT-PY@CERTpyDisclosure

The tweet announces vulnerabilities in ManageEngine products by listing two CVEs and providing a link for more information. It lacks details on exploitation, remediation, or technical specifics.

iototsecnews@iototsecnewsPatch

The post highlights a critical RCE vulnerability in ManageEngine ADSelfService Plus and stresses the importance of patching to build 7001 or later, along with additional mitigation steps.

NotCVE@notCVEGeneral

The tweet lists three CVEs with high EPSS scores and CVSS ratings, highlighting them as likely future exploitation targets, but provides no PoC, exploit code, active exploitation evidence, or patch information.

Cybersecurity News DE@cybsecuritynewsDisclosure

The tweet announces a critical RCE vulnerability in ManageEngine ADSelfService Plus GINA client prior to Build 7001, without mentioning exploits, active use, or a patch.