CVE-2026-11374

CriticalCVSS 9.0/10Last modified Jun 24, 2026

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-330 CWE-340

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
zohocorp	manageengine_adselfservice_plus	< 6529
zohocorp	manageengine_recovery_manager_plus	< 6321
zohocorp	manageengine_m365_manager_plus	< 4817
zohocorp	manageengine_adaudit_plus	< 8703

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Timeline

Published: Jun 23, 2026
Last modified: Jun 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1137406.3A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the fil CVE-2026-1137414.3A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-1137436.3A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the CVE-2026-11374410.0A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /g CVE-2026-1137487.8Stack-based buffer overflow in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.CVE-2026-1137497.5Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.CVE-2026-113758.8IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overfl CVE-2026-1137507.0Heap-based buffer overflow in Windows Device Inventory allows an authorized attacker to elevate privileges locally.CVE-2026-1137517.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized CVE-2026-1137527.5Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-1137538.2Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-1137544.7Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.