CVE-2026-2740

HighCVSS 8.4/10Last modified Jul 23, 2026

Description

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Zohocorp	ManageEngine ADSelfService Plus	< 6525
Zohocorp	ManageEngine DataSecurity Plus	< 6264
Zohocorp	ManageEngine RecoveryManager Plus	< 6313

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-2740.html

Timeline

Published: May 21, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-274008.6Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-274015.3Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows CVE-2026-274027.1Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.CVE-2026-274036.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XS CVE-2026-274047.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.CVE-2026-274056.5Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. CVE-2026-274067.5Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.CVE-2026-274077.2Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-274087.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch al CVE-2026-274095.3Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. CVE-2026-27416.8Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through CVE-2026-274106.5Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.