CVE-2026-11374: Account Takeover via Predictable SSO Ticket Generation

Synopsis

This is an authentication bypass via predictable SSO ticket generation affecting ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus. The vulnerability is reachable over the network and requires no authentication, though successful exploitation depends on environmental timing and prediction conditions (CVSS AC:H). A remote unauthenticated attacker who predicts a valid SSO ticket gains full account takeover, with complete read, write, and availability impact across the affected service and potentially connected systems (CVSS scope change: C). Patched-image rebuilds at the respective fix versions (4817, 6321, 6529, 8703) are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; all four products expose network-accessible endpoints that serve SSO ticket validation.

• AuthenticationNot required

  No account or credentials are needed at any point; ticket prediction is performed entirely by an unauthenticated party.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must overcome environmental conditions such as timing constraints or entropy-related factors to successfully predict a valid SSO ticket.

Blast Radius

• A successful attacker takes over an arbitrary user account, including administrator accounts, on the targeted ManageEngine product.
• With a hijacked session the attacker reads sensitive directory data, audit logs, M365 tenant configurations, and stored credentials or recovery information managed by the platform.
• The attacker modifies user accounts, recovery workflows, audit configurations, or M365 policy objects persisted by the affected service.
• Because the CVSS scope is changed (S:C), the attacker can pivot from the compromised ManageEngine product into connected systems such as Active Directory, Azure AD tenants, or any service the platform is authorized to manage.