Critical 9.0Published Jun 23, 2026

CVE-2026-11374Account Takeover via Predictable SSO Ticket Generation

Updated under an hour ago (Oct 27, 2026, 11:40 AM ET)

Does this affect you?

It affects zohocorp manageengine_adselfservice_plus and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for zohocorp manageengine_adselfservice_plus

Exploited in the last 30 days

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVSS: 9.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-340, CWE-330, CWE-287
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Zohocorp
NVD analysis: Awaiting Analysis
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

zohocorp manageengine_adselfservice_plus zohocorp:manageengine_adselfservice_plus (from the name)	before 6529	CNA record
zohocorp manageengine_recovery_manager_plus zohocorp:manageengine_recovery_manager_plus (from the name)	before 6321	CNA record
zohocorp manageengine_m365_manager_plus zohocorp:manageengine_m365_manager_plus (from the name)	before 4817	CNA record
zohocorp manageengine_adaudit_plus zohocorp:manageengine_adaudit_plus (from the name)	before 8703	CNA record

References

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.