CVE-2026-11374
Critical
Description
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
SeverityCritical
CVSS9.0
Exploit probability—
ProductZohocorp Manageengine Adselfservice Plus
PublishedJun 23, 2026
First seenJun 23, 2026
How to fix
Update
- zohocorp manageengine_adselfservice_plus6529 or later
- zohocorp manageengine_recovery_manager_plus6321 or later
- zohocorp manageengine_m365_manager_plus4817 or later
- zohocorp manageengine_adaudit_plus8703 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_adselfservice_plus | v < 6529 | 6529 |
| zohocorp manageengine_recovery_manager_plus | v < 6321 | 6321 |
| zohocorp manageengine_m365_manager_plus | v < 4817 | 4817 |
| zohocorp manageengine_adaudit_plus | v < 8703 | 8703 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.