CVE-2026-11374

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Score

CVSS 3.1 9.0 Critical

Status

Awaiting Analysis - 0fc0942c-577d-436f-ae8e-945763c79b02

Published

2026-06-23

Last modified

2026-06-24

Weaknesses

CWE-287, CWE-330, CWE-340

Affected products

• Manageengine Adaudit Plus (Zohocorp)
• Manageengine Adselfservice Plus (Zohocorp)
• Manageengine M365 Manager Plus (Zohocorp)
• Manageengine Recovery Manager Plus (Zohocorp)

References

• https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html