The vulnerability allows an unauthenticated attacker to predict the single sign‑on tickets used by ManageEngine ADAudit Plus, ADSelfService Plus, M365 Manager Plus, and Recovery Manager Plus. Predicting these tickets leads to unauthorized session hijacking and full account takeover. The weakness is rooted in poor entropy generation and authentication bypass, classified as CWE‑287, CWE‑330, and CWE‑340.

The affected products are ManageEngine ADAudit Plus, ManageEngine ADSelfService Plus, ManageEngine M365 Manager Plus, and ManageEngine Recovery Manager Plus. Specific version information is not provided, so all available releases at the time of disclosure may be vulnerable.

The CVSS score is 9, indicating critical severity. EPSS data is not available, so the exact exploitation probability is unknown, but the lack of authentication to generate tickets makes the attack vector remote over the network. The vulnerability is not listed in the CISA KEV catalog, yet the criticality and ease of exploitation warrant prompt action.