ManageEngine ADSelfService Plus 7001 Fixes RCE and Authentication Bypass
Tech GuruQuick Answer
ManageEngine ADSelfService Plus build 7001 fixes two different issues in builds 7000 and earlier: SYSTEM-context execution through the Windows logon-screen GINA client, and an unauthenticated REST API authorization bypass. Plan validation for both the server and affected endpoint workflow.
Confirm Scope And Apply The Supported Fix
What to do now: Apply the supported 7001-or-later service pack, inventory endpoints using the GINA logon component, and confirm the vendor-supported client rollout requirements rather than assuming a server build readback proves every endpoint changed.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ManageEngine ADSelfService Plus builds 7000 and earlier |
|---|---|
| Advisory | CVE-2026-74849 / CVE-2026-75791 |
| CVEs | CVE-2026-74849, CVE-2026-75791 |
| Authoritative release date | Vendor pages: fixed on 2026-08-24. Advisory publication dates are not separately verified. Zoho CVE records were published 2026-09-22. |
| Authority revision date | No vendor-page revision timestamp verified. CVE-record updates are separate metadata and are not evidence of vendor-advisory revisions. |
| Affected versions | ADSelfService Plus builds 7000 and earlier, including the GINA logon-screen client and REST API authorization paths. |
| Fixed version | ManageEngine ADSelfService Plus build 7001 or later |
| CVSS base score | Zoho CNA records: CVE-2026-74849 9.8; CVE-2026-75791 8.6 (CVSS v3.1). The GINA vendor page instead labels severity High and specifies Windows logon-screen access; retain that prerequisite despite the CNA network vector. |
| CVSS severity | High to Critical |
| Exploitation status | The checked ManageEngine vendor advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The GINA advisory requires access to the Windows logon screen; the REST issue allows remote access to normally administrator-restricted operations under the described conditions. Both vendor pages say the fixes were available on August 24, 2026. Their CVE records were published in September; those dates must not be presented as the original vendor advisory dates.
What To Validate Now
- Inventory. Locate ManageEngine ADSelfService Plus builds 7000 and earlier deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: ADSelfService Plus builds 7000 and earlier, including the GINA logon-screen client and REST API authorization paths. Do not infer applicability from product family or severity alone.
- Remediate. Update ADSelfService Plus to build 7001 or a later supported build using the vendor service pack. Verify the GINA endpoint deployment requirements with the vendor; this notice does not establish a separate client build matrix.
- Validate. Record server and applicable endpoint-component versions, then test approved password-reset/unlock, endpoint sign-in and authorized REST operations. Confirm restricted operations remain restricted without disruptive production exploit testing.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
