CVE-2026-11374
EUVD-2026-3842323.06.2026, 09:16
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| zohocorp | manageengine_adselfservice_plus | 𝑥 < 6529 | CNA |
| zohocorp | manageengine_m365_manager_plus | 𝑥 < 4817 | CNA |
| zohocorp | manageengine_adaudit_plus | 𝑥 < 8703 | CNA |
Common Weakness Enumeration