CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation

State: Published
Severity: 9.0 Critical
Published: Jun 23, 2026
Updated: Jun 24, 2026
Reserved: Jun 5, 2026

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	Zohocorp

Weaknesses

CWE-340 Generation of Predictable Numbers or Identifiers
CWE-330 Use of Insufficiently Random Values
CWE-287 Improper Authentication

Affected Products

Product	Versions
manageengine_adselfservice_pluszohocorp	before 6529Affected
manageengine_recovery_manager_pluszohocorp	before 6321Affected
manageengine_m365_manager_pluszohocorp	before 4817Affected
manageengine_adaudit_pluszohocorp	before 8703Affected

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.