CVE-2026-11374

critical · 9

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVSS

2.5%

EPSS (exploit prob.)

84th

EPSS percentile

2026-06-23

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-287CWE-330CWE-340

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-11374