Introduction
A command injection flaw in three widely deployed ManageEngine products lets any authenticated domain user execute arbitrary commands on endpoint machines running the products' agents. CVE-2026-2740 affects ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus. It has a CVSS score of 8.4, which puts it in the high-severity range.
ManageEngine, a division of Zohocorp, builds enterprise IT management software that organizations worldwide use for identity management, data protection, and Active Directory operations. These products are common in large enterprise environments, so the agent footprint on domain-joined endpoints can be substantial. That placement raises the impact. The affected agents sit on workstations and servers throughout the network, so each one is a potential execution target.
Technical Information
CVE-2026-2740 is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. The root cause combines two issues: insufficient access controls on the service that installs and manages agents on client machines, and a bug in a third-party dependency that the affected products use.
Attack Flow
The attacker must be an authenticated domain user. That is a relatively low bar in most enterprise environments, especially in post-compromise scenarios where the attacker has already obtained domain credentials through phishing, credential stuffing, or lateral movement.
Once authenticated, the attacker can interact with the service communication channel between the ManageEngine server and the client endpoints where agents are installed. In normal operation, this channel handles agent deployment and management. The improper access controls on the service, together with the third-party dependency bug, let the attacker inject commands through it.
The injected commands execute directly on the client machine that hosts the agent. These are the affected agents:
| Product | Vulnerable Agent Component |
|---|---|
| ADSelfService Plus | ADSelfService Plus login agent |
| RecoveryManager Plus | RecoveryManager Plus backup agent |
| DataSecurity Plus | DataSecurity Plus agent |
These agents typically run with elevated privileges on domain-joined systems, so successful exploitation could let an attacker establish persistent footholds, move laterally, or exfiltrate data from endpoints across the environment. Because one vulnerability spans three distinct products and their agents, organizations running more than one of these solutions face a considerably larger attack surface.
The vendor's advisory attributes part of the root cause to a "bug in the 3rd party dependency," but the dependency has not been publicly named. The fix hardened the access controls on the agent deployment service, which suggests the third-party component was being used in a way that bypassed the intended authorization checks.
Affected Systems and Versions
The following products and version ranges are confirmed vulnerable:
| Product | Affected Versions | Fixed Version | Fix Release Date |
|---|---|---|---|
| ADSelfService Plus | Build 6524 and earlier | Build 6525 | 5 February 2026 |
| DataSecurity Plus | Build 6263 and earlier | Build 6264 | 13 February 2026 |
| RecoveryManager Plus | Build 6312 and earlier | Build 6313 | 24 March 2026 |
Any endpoint running the login agent, backup agent, or data security agent from these products at the listed vulnerable versions is at risk. In this case, exploitation targets the agents, not only the server components.
Vendor Security History
ManageEngine products have had earlier security issues. CVE-2020-11532 involved default admin credentials in DataSecurity Plus that allowed communication with a DataEngine Xnode server. That is a different class of vulnerability, but it is another reason to scrutinize access controls in ManageEngine deployments.
For CVE-2026-2740, ManageEngine published its advisory and released patches before the National Vulnerability Database entry was finalized. That early disclosure is a good sign. The staggered release schedule (February through March 2026 across the three products) means organizations may have had uneven exposure windows, depending on which products they run.
