CVE Intelligence

Zohocorp ManageEngine RecoveryManager Plus vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Zohocorp ManageEngine RecoveryManager Plus: 2 record(s), with affected versions and fixes.

CVE-2026-11374 Critical · 9.0 CWE-287 Jun 23, 2026
ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus: predictable SSO ticket leading to account takeover (CVE-2026-11374)
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
CVE-2026-2740 High · 8.4 CWE-77 May 21, 2026
Remote Code Execution
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.