CVEvulnerability

CVE-2026-11374

9.0 CRITICAL Published 2026-06-23 Modified 2026-06-24 Official page ↗
Status
Awaiting Analysis
Published
2026-06-23
Last modified
2026-06-24
Assigner
0fc0942c-577d-436f-ae8e-945763c79b02
CVSS 3.1 (0fc0942c-577d-436f-ae8e-945763c79b02)
9.0 CRITICAL — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-330, CWE-340

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Related

Weakness · CWE (3)

  • CWE-287 Improper Authentication weakness
  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-340 Generation of Predictable Numbers or Identifiers weakness

References