CVE-2026-11374EPSS p84.3%

CVE-2026-11374CVE-2026-11374

Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Scoring

CVSS 9.0 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS2.52% probability of exploitation · percentile 84.3% · 2026-10-05T12:00:23Z
Last modified2026-06-24
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.