CVE-2026-11374: Account Takeover via Predictable SSO Ticket Generation

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-06-24
Weakness: CWE-287

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Affected products

ManageEngine ADAudit Plus: before 8703 — fixed in 8703
ManageEngine ADSelfService Plus: before 6529 — fixed in 6529
Zohocorp ManageEngine M365 Manager Plus: before 4817 — fixed in 4817
zohocorp manageengine_recovery_manager_plus: before 6321 — fixed in 6321

How to fix

Upgrade to a fixed version: ManageEngine ADAudit Plus 8703; ManageEngine ADSelfService Plus 6529; Zohocorp ManageEngine M365 Manager Plus 4817; zohocorp manageengine_recovery_manager_plus 6321. Check the vendor advisory for mitigations.

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Get alerted when CVE-2026-11374 or the next vulnerability affects your stack