Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zohocorp

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zohocorp manageengine_adselfservice_plus

Default version status: unaffected

  • 0 to < 6529affected

zohocorp manageengine_recovery_manager_plus

Default version status: unaffected

  • 0 to < 6321affected

zohocorp manageengine_m365_manager_plus

Default version status: unaffected

  • 0 to < 4817affected

zohocorp manageengine_adaudit_plus

Default version status: unaffected

  • 0 to < 8703affected

References