CVE-2026-11374
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 2.52%
- CWE
- CWE-340, CWE-330, CWE-287
- Published
- 2026-06-23
- Last modified
- 2026-06-24
Affected products
- zohocorp manageengine_adselfservice_plus
- zohocorp manageengine_recovery_manager_plus
- zohocorp manageengine_m365_manager_plus
- zohocorp manageengine_adaudit_plus
Weakness type
Related vulnerabilities
- CVE-2026-64964 — Generation of Predictable Email Confirmation Token in ATutor
- CVE-2025-14602 — Weak File Name Generation in vsDesk
- CVE-2026-75106 — OpnForm Editable Submission Secret Derivation via Empty Hashids Salt
- CVE-2026-13577 — Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable
- CVE-2026-47085 — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can...
- CVE-2026-56016 — CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources
- CVE-2026-9219 — Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers
- CVE-2026-9733 — Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter