---
cve: "CVE-2026-11374"
severity: "CRITICAL"
cvss: 9.0
epss: "2%"
vendor: "Zohocorp"
kev: false
exploited: false
published: "2026-06-23 09:16:28"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-08-31T12:18:45+02:00"
---

# CVE-2026-11374

> 9.0 CRITICAL

## Beschreibung

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted
 by an unauthenticated user, leading to account takeover.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Referenzen

- <https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-11374) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_