CVE-2026-11374: ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus: predictable SSO ticket leading to account takeover
CVE-2026-11374 affects four ManageEngine products and concerns SSO tickets that are generated to authenticate a session and could be predicted by an unauthenticated user. The CNA classifies the issue as critical with a CVSS 3.1 base score of 9.0 and maps it to CWE-287 (Improper Authentication), with account takeover named as the consequence. At the time of analysis the record lists no affected versions, no fixed versions and no KEV listing.
Overview
CVE-2026-11374 is described by the CNA as a weakness in single sign-on (SSO) ticket generation in four ManageEngine products: ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus. The SSO tickets used to authenticate a session could be predicted by an unauthenticated user. The record maps the weakness to CWE-287 (Improper Authentication).
Impact
- The CNA describes the consequence as account takeover.
- The CNA scores the issue at CVSS 3.1 base score 9.0 (critical), with high confidentiality, integrity and availability impact and scope changed.
- The attack vector is listed as network, with no privileges and no user interaction required, although the record lists attack complexity as high.
Affected products and versions
- ManageEngine ADSelfService Plus
- ManageEngine RecoveryManager Plus
- ManageEngine M365 Manager Plus
- ManageEngine ADAudit Plus
The record does not list specific affected version ranges. Administrators should consult the vendor advisory for version details.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted for this analysis. EPSS data is not available in the record.
Remediation and mitigation
- Check the vendor advisory at ManageEngine advisory for fixed builds for each affected product.
- Apply the vendor-provided fix as soon as it is confirmed for your installed versions, and prioritise internet-facing or widely exposed instances.
- Until a fix is applied, restrict network access to the management interfaces of these products and review whether SSO login is required for exposed services.
- Review accounts that may have been accessed through SSO on the affected products, and reset credentials where suspicious activity is found.
Detection guidance
- Review authentication logs of the four products for SSO logins that lack a corresponding interactive authentication step or that originate from unexpected addresses.
- Look for unexplained administrative actions, new accounts, or configuration changes on the products.
- Correlate directory and identity provider logs with product logs to identify logins that do not match normal user behaviour.
Limitations of the available information
The record does not provide affected or fixed version numbers, a confirmed patch list, technical details of how tickets are generated, or exploitation evidence. The CVSS vector and score come from the CNA and have not been independently verified. The EPSS and SSVC fields are empty. Statements about impact are limited to the CNA description.
Frequently asked questions
What is CVE-2026-11374?
It is a CNA-reported weakness in which SSO tickets used to authenticate sessions in four ManageEngine products could be predicted by an unauthenticated user, leading to account takeover.
Which products are affected?
The record names ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus. It does not list specific affected version ranges.
Is this vulnerability actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.