# CVE-2026-11374

## Summary

- **CVE ID:** CVE-2026-11374
- **Severity:** CRITICAL
- **CVSS Score:** 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-340, CWE-330, CWE-287
- **Published:** Jun 23, 2026
- **Last Modified:** Jun 24, 2026

## Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted
 by an unauthenticated user, leading to account takeover.

## Affected Products

- zohocorp — manageengine_adselfservice_plus (0)
- zohocorp — manageengine_recovery_manager_plus (0)
- zohocorp — manageengine_m365_manager_plus (0)
- zohocorp — manageengine_adaudit_plus (0)

## References

- [CNA](https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 2.52%
- **EPSS Percentile:** 83.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._