Vulnerability · Published Jun 23, 2026 · Assigned by Zohocorp
CVE-2026-11374Account Takeover via Predictable SSO Ticket Generation
Critical 9.0
In plain English
A critical-severity weak randomness in manageengine_adaudit_plus from zohocorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zohocorp | manageengine_adselfservice_plus | 0 – before 6529 |
| zohocorp | manageengine_recovery_manager_plus | 0 – before 6321 |
| zohocorp | manageengine_m365_manager_plus | 0 – before 4817 |
| zohocorp | manageengine_adaudit_plus | 0 – before 8703 |
Weakness: CWE-340, CWE-330, CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H