CVE-2026-2740
High
Description
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
SeverityHigh
CVSS8.4
Exploit probability—
ProductManageEngine ADSelfService Plus
PublishedMay 21, 2026
First seenMay 21, 2026
Weakness typeCWE-77Command injection
How to fix
Update
- Zohocorp ManageEngine ADSelfService Plus6525 or later
- Zohocorp ManageEngine DataSecurity Plus6264 or later
- Zohocorp ManageEngine RecoveryManager Plus6313 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zohocorp ManageEngine ADSelfService Plus | v < 6525 | 6525 |
| Zohocorp ManageEngine DataSecurity Plus | v < 6264 | 6264 |
| Zohocorp ManageEngine RecoveryManager Plus | v < 6313 | 6313 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.