CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation

Published Jun 23, 2026 CVSS 3.1 · 9 Critical EPSS 2.5% KEV · Not listed

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted
by an unauthenticated user, leading to account takeover.

Analysis

Technical impact

In ManageEngine ADSelfService Plus, Recovery Manager Plus, M365 Manager Plus, and ADAudit Plus the single sign‑on ticket generation uses insufficient entropy, allowing an unauthenticated user to predict the tickets. With a predicted ticket the attacker can obtain an authenticated session, effectively assuming the account. The vulnerability is classified around authentication, insufficient randomness, and replay risks.

Affected Systems

The vulnerable products are ManageEngine ADAudit Plus, ManageEngine ADSelfService Plus, ManageEngine M365 Manager Plus, and ManageEngine Recovery Manager Plus. The advisory does not list specific version numbers, so any currently released version may be affected.

Risk and Exploitability

The CVSS score of 9 categorizes the flaw as critical, and the EPSS score of 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can exploit the flaw remotely by issuing a request to the ticket generation endpoint as an unauthenticated user and using the predictable ticket to forge an authenticated session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zohocorp

manageengine_adselfservice_plus

unaffected

Version	Status	Constraints
`0`	affected	< 6529

zohocorp

manageengine_recovery_manager_plus

unaffected

Version	Status	Constraints
`0`	affected	< 6321

zohocorp

manageengine_m365_manager_plus

unaffected

Version	Status	Constraints
`0`	affected	< 4817

zohocorp

manageengine_adaudit_plus

unaffected

Version	Status	Constraints
`0`	affected	< 8703

No data.

Vendor Product Versions

Zohocorp

Manageengine Adaudit Plus

Version	Status	Scheme	Platform
`[0,8703)`	affected	generic	['windows']

Zohocorp

Manageengine Adselfservice Plus

Version	Status	Scheme	Platform
`[0,6529)`	affected	generic	['windows']

Zohocorp

Manageengine M365 Manager Plus

Version	Status	Scheme	Platform
`[0,4817)`	affected	generic	['windows']

Zohocorp

Manageengine Recovery Manager Plus

Version	Status	Scheme	Platform
`[0,6321)`	affected	generic	['windows']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest vendor‑supplied patch or upgrade to the newest general‑availability release of the affected ManageEngine products.
Deploy network controls (firewall rules, API gateway policies, or server‑side ACLs) to restrict unauthenticated access to the SSO ticket generation endpoint.
Enable multi‑factor authentication for all privileged and regular user accounts to reduce the impact of a successful ticket prediction.

Generated by OpenCVE AI on June 24, 2026 at 11:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.5% (2.523% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

History

Jun 24, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 12:30 PM First appearance in the feed. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Zohocorp Zohocorp manageengine Adaudit Plus Zohocorp manageengine Adselfservice Plus Zohocorp manageengine M365 Manager Plus Zohocorp manageengine Recovery Manager Plus
Vendors & Products		Zohocorp Zohocorp manageengine Adaudit Plus Zohocorp manageengine Adselfservice Plus Zohocorp manageengine M365 Manager Plus Zohocorp manageengine Recovery Manager Plus
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 9:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
Title		Account Takeover via Predictable SSO Ticket Generation
Weaknesses		CWE-287 CWE-330 CWE-340
References		https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}`