ManageEngine has patched a high-severity remote code execution flaw in its ADSelfService Plus software that potentially grants unauthenticated attackers the highest local privileges on Windows systems. Tracked under CVE-2026-74849, the bug allows attackers to run code as NT AUTHORITY\SYSTEM directly from the Windows login screen. This affects versions using the GINA client in builds 7000 and earlier, while build 7001 and later include the fix.
How the Vulnerability Works
The weakness is rooted in the GINA client component of ADSelfService Plus, which embeds a browser-like interface in the Windows logon screen. This interface enables functions like password resets or account unlocks before a user ever logs in. An attacker who can access this screen can exploit it to run arbitrary commands under the SYSTEM account—the most privileged local context on Windows. Once they have SYSTEM, they can alter critical system files, install services, disable security tools, modify user accounts, and establish deep, persistent access to the compromised device. The technical issue is classified as an OS command injection vulnerability (CWE-78).
Severity and Mitigation Steps
This vulnerability is considered critical, receiving a CVSS v3.1 score of 9.8 out of 10. Key factors driving this rating include its exploitability over the network with no user interaction and no required privileges. Because login-screen software runs with elevated permissions before authentication, the risk is especially serious.
ManageEngine released the patched version (build 7001) on August 24, 2026. Organizations using ADSelfService Plus with the GINA client in any build at or below 7000 should upgrade immediately. The update improves error handling and secures the embedded browser component exposed at the login screen.
What You Should Do Now
In addition to upgrading, system administrators should scan for any instances of the vulnerable GINA client and check installed builds. Monitoring tools should inspect endpoint logs for signs of misuse—look for unexpected command execution, unauthorized service creation, changes to privileged accounts, or other suspicious activity around login-screen events.
If an immediate update isn’t possible, organizations should implement temporary mitigations: restrict access to affected login screens both physically and over the network, isolate systems exposed to untrusted or remote access, and closely monitor these hosts for unusual behavior. Still, these measures don’t replace applying the patch.
The flaw was reported via a vendor bug bounty program by two researchers, Marouane Belabbassi and Amjad E Alhejaili. With unauthenticated SYSTEM-level execution possible on vulnerable endpoints, patching is imperative.
What this means: Systems that haven’t updated are wide open. Especially on devices that may be physically accessible by untrusted users or exposed to network connections before user logon—these environments are now high-value targets for attackers.
Why this matters: The ability to gain SYSTEM access without user credentials is among the most dangerous vulnerabilities there is. It bypasses the usual protections of user accounts and security tools. Attackers exploiting this could establish footholds that are nearly impossible to detect or eliminate without deep forensic work.
