CVE-2026-11374 — Account Takeover via Predictable SSO Ticket Generation

CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation PUBLISHED

Description (CNA)

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Affected (CNA)

Vendor / product	Versions
zohocorp / manageengine_adselfservice_plus	affected 0 before 6529
zohocorp / manageengine_recovery_manager_plus	affected 0 before 6321
zohocorp / manageengine_m365_manager_plus	affected 0 before 4817
zohocorp / manageengine_adaudit_plus	affected 0 before 8703

CWE

CWE-340, CWE-330, CWE-287

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.