VULNERABILITY INTELLIGENCE
CVE-2026-11374
CVSS score9 CRITICAL
EPSS probability2.52%
CISA KEVNot currently listed
Published2026-06-23
Last modified2026-06-24
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
Weakness classification
- CWE-287: Improper Authentication
- CWE-330: Use of Insufficiently Random Values
- CWE-340: Generation of Predictable Numbers or Identifiers