Zohocorp ManageEngine RCE in ADSelfService Plus, DataSecurity Plus, RecoveryManager Plus

The National Vulnerability Database has disclosed CVE-2026-2740, an authenticated remote code execution vulnerability impacting Zohocorp’s ManageEngine ADSelfService Plus (versions before 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313). This high-severity flaw, with a CVSSv3.1 score of 8.4, stems from a bug in a third-party dependency used by these products, specifically affecting agent machines.

Attackers exploiting this vulnerability could gain significant control over targeted systems, leveraging authenticated access to execute arbitrary code. The critical aspect here is the ‘authenticated’ prerequisite; it means an attacker already has a foothold or valid credentials, making this a privilege escalation or lateral movement vector rather than an initial access method. However, the impact — full remote code execution — is severe, allowing for data exfiltration, further system compromise, or disruption.

Defenders must prioritize patching these Zohocorp products immediately. The existence of a third-party dependency bug highlights the pervasive supply chain risk in modern software. CISOs need to ensure their patching cadence accounts for not just direct product vulnerabilities but also those inherited through dependencies, especially for critical infrastructure components like identity management and data security solutions.