Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
ManageEngine ADSelfService Plus Flaw Lets Unauthenticated Attackers Execute Code as SYSTEM
Malware Families
Excerpt
ManageEngine has fixed a high-severity remote code execution vulnerability in ADSelfService Plus that could allow an unauthenticated attacker with physical access to a Windows logon screen to execute arbitrary code as NT AUTHORITY\SYSTEM. Tracked as CVE-2026-74849, the flaw affects the product’s GINA client component, which integrates ADSelfService Plus password reset and account-unlock functions into the Windows logon experience. The issue affects ADSelfService Plus builds…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-74849 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…