What is the CVSS score of CVE-2026-11374?

CVE-2026-11374 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

How to fix or mitigate CVE-2026-11374?

Within 24 hours: Identify all ManageEngine products in use (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) and document current versions. Within 7 days: Restrict console network access via firewall to approved IP ranges (geoblocking, IP whitelisting); enable detailed authentication audit logging; evaluate feasibility of temporarily disabling SSO functionality. Within 30 days: Establish patch availability timeline with ManageEngine; evaluate alternative identity management products if vendor remediation exceeds acceptable risk tolerance.

ManageEngine ADSelfService Plus CVE-2026-11374

Q: Which versions of ManageEngine ADSelfService Plus are affected by CVE-2026-11374?

Unauthenticated attackers can compromise all user accounts in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus by predicting session tokens, creating a…. A patch is available.

EUVD-2026-38423 CRITICAL

Generation of Predictable Numbers or Identifiers (CWE-340)

2026-06-23 Zohocorp

GHSA-hp5g-5g9f-49wq

Zoho Information Disclosure Manageengine Adselfservice Plus Manageengine Recovery Manager Plus Manageengine M365 Manager Plus Manageengine Adaudit Plus

9.0

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable SSO endpoint, no auth or UI, but predicting a ticket is non-trivial (AC:H); scope changes as session compromise pivots into managed AD/M365 identities.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 23, 2026 - 11:16 EUVD

Analysis Generated

Jun 23, 2026 - 09:29 vuln.today

DescriptionCVE.org

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

AnalysisAI

Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory.

Technical ContextAI

All four products are Zoho ManageEngine identity and directory-management web applications that share a common SSO subsystem. The flaw is a CWE-340 (Generation of Predictable Numbers or Identifiers) weakness in how SSO tickets - the short-lived tokens that bind a freshly authenticated user to a server-side session - are generated, indicating the underlying RNG, seed, or token derivation function is not cryptographically strong. Because the ticket is what the application accepts as proof of authentication, any predictability collapses the entire SSO trust boundary across these products.

RemediationAI

Patch available per vendor advisory - upgrade each affected ManageEngine product to the fixed build listed in the Zoho advisory at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html (exact fix version not provided in the input data and should be confirmed against the advisory before scheduling). Until patches are applied, restrict network exposure of the ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus web consoles to trusted management VLANs or via VPN/reverse proxy with IP allow-listing (trade-off: breaks remote self-service password reset for end users), and consider temporarily disabling SSO and forcing direct form-based authentication on these consoles (trade-off: degrades user experience and may break federated workflows). Increase monitoring for anomalous session establishment, repeated failed SSO ticket validation, and successful logins without a preceding interactive authentication event.