CVE-2026-11374

9.0 criticalEPSS 2.5%

Critical (9.0). EPSS 2.5% chance of exploitation in the next 30 days.

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Severity

CVSS 3.1

9.0 critical

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs: CWE-287, CWE-330, CWE-340
Published: 2026-06-23
Modified: 2026-06-24
Record from: the NVD, synced 2026-10-19

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html

Check your stack JSON