TI-2026-09819 Aliases CVE-2026-11374 GHSA-hp5g-5g9f-49wq

Account Takeover via Predictable SSO Ticket Generation

MEDIUM 46CWE-287Published 2026-06-23 · Updated 2026-06-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02523 84th percentileScored 2026-11-07

Fix Fixed manageengine_adselfservice_plus (zohocorp): 6529manageengine_recovery_manager_plus (zohocorp): 6321+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zohocorp	manageengine_adselfservice_plus	before 6529	6529	Patch available	CNA
Zohocorp	manageengine_recovery_manager_plus	before 6321	6321	Patch available	CNA
Zohocorp	manageengine_m365_manager_plus	before 4817	4817	Patch available	CNA
Zohocorp	manageengine_adaudit_plus	before 8703	8703	Patch available	CNA

manageengine_adselfservice_plus VendorZohocorp Affected before 6529 Fixed in 6529 Patch available CNA
manageengine_recovery_manager_plus VendorZohocorp Affected before 6321 Fixed in 6321 Patch available CNA
manageengine_m365_manager_plus VendorZohocorp Affected before 4817 Fixed in 4817 Patch available CNA
manageengine_adaudit_plus VendorZohocorp Affected before 8703 Fixed in 8703 Patch available CNA

Remediation

Fix · CNA manageengine_adselfservice_plus (zohocorp) Fixed in 6529
Fix · CNA manageengine_recovery_manager_plus (zohocorp) Fixed in 6321
Fix · CNA manageengine_m365_manager_plus (zohocorp) Fixed in 4817
Fix · CNA manageengine_adaudit_plus (zohocorp) Fixed in 8703

Timeline

2026-10-02 Threatist record created from CVE-2026-11374
2026-10-03 Alias added: GHSA-hp5g-5g9f-49wq

References

Other 1

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8

See all 611 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences