CVE-2026-113749.0CriticalCWE-340

CVE-2026-11374: Account Takeover via Predictable SSO Ticket Generation

zohocorp · manageengine_adselfservice_plus

Vendor fix available · Affected: zohocorp manageengine_adselfservice_plus · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub20 Jul
Not established: not seen

2.5%probability of exploitation in the next 30 days

85th percentile

050100

Higher than 85% of scored CVEs

9.0CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionNVD

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Generation of Predictable Numbers or Identifiers · Cryptography
Vendor: zohocorp
Published: June 2026
Band: Possible (1 to 10%), June 2026

What changed

20 Jul
PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 25 Jun.

25 Jun 05:20
Zoho patches critical SSO ticket flaw in ManageEngine AD360 suite
SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.