Zoho ManageEngine security advisory for CVE-2026-74849 documents remote code execution in the ADSelfService Plus GINA client — the self-service password-reset / account-unlock portal shown on the Windows logon screen via an embedded (kiosk) browser. An unauthenticated attacker with access to the Windows logon screen may leverage the embedded browser to execute code as NT AUTHORITY\SYSTEM and fully compromise the host.

Vendor severity High. Affected: builds 7000 and below. Fixed: build 7001 (fixed on 24 August 2026) by correcting error handling and hardening the embedded logon-screen browser; update via the service pack.

Reported by Marouane Belabbassi and Amjad E Alhejaili via Zoho BugBounty. Industry wires (Cyber Security News 23 Sep 2026) cited a CVSS 9.8 figure.

The vendor advisory page shows only severity High, but Zoho's own CVE record (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

No in-the-wild exploitation claimed in the vendor advisory. WASOC advisory 20260924001 (24 Sep 2026) lists CVE-2026-74849 as Critical CVSS 9.8 (versions 7000 and below) alongside Applications Manager CVE-2026-86708 and OpManager MSP CVE-2026-19599, and states no exploitation observed on WA Government networks at time of writing — WASOC’s 9.8 matches the score on Zoho’s CVE record.

Primary: ManageEngine CVE-2026-74849 advisory; AU: WASOC 20260924001.

Correction (23 Oct 2026): this card said the CVSS 9.8 figure was not the vendor's and recorded only the advisory page's High rating.

Zoho's own CVE record for CVE-2026-74849 (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8. (source: CVE-2026-74849 record (cve.org))