High severity · published May 21, 2026
CVE-2026-2740
Remote Code Execution
8.4
CVSS
1.7%
EPSS
No
On KEV
Description
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
ManageEngine ADSelfService Plus · Zoho
before 6525 · source: vendor
MD
ManageEngine DataSecurity Plus · Zohocorp
before 6264 · source: vendor
MR
ManageEngine RecoveryManager Plus · Zohocorp
before 6313 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2740
www.manageengine.com
https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-2740.html
More from ManageEngine ADSelfService Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-40539
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
9.8
CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
6.8
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability