CVE-2026-2740 is an authenticated command injection vulnerability (CWE-77) affecting Zohocorp ManageEngine ADSelfService Plus versions prior to 6525, as well as related products DataSecurity Plus and RecoveryManager Plus before specified versions. The issue arises from improper neutralization of special elements in commands, allowing authenticated attackers to execute arbitrary code remotely on agent machines. The vulnerability is due to a flaw in a third-party dependency. The CVSS 3.1 base score is 8.4, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity with low impact on availability. No patch or official remediation level has been published by the vendor as of the provided data.

Successful exploitation allows an authenticated attacker to execute arbitrary code remotely on agent machines, potentially compromising confidentiality and integrity of affected systems. Availability impact is low. This could lead to unauthorized control over agent machines within the environment running vulnerable versions of the affected products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should restrict access to the affected products to trusted authenticated users only and monitor for vendor updates. Avoid exposing vulnerable services to untrusted networks until a fix is available.