CVE-2026-11374

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Traduire en français

Produits concernés

• zohocorp manageengine_adselfservice_plus
• zohocorp manageengine_recovery_manager_plus
• zohocorp manageengine_m365_manager_plus
• zohocorp manageengine_adaudit_plus

Scores CVSS

Faiblesses (CWE)

• CWE-287
• CWE-330
• CWE-340

Références

• https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories