CVE-2026-11374 — CRITICAL (9.0)

Vulnerability Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVSS Score

9.0

CRITICAL

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-340 CWE-287 CWE-330

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11

FAQ

What is CVE-2026-11374?

CVE-2026-11374 is a vulnerability with a CVSS score of 9.0 (CRITICAL). In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, le...

How severe is CVE-2026-11374?

CVE-2026-11374 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-11374?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.