Zoho ManageEngine ADSelfService Plus generation of predictable numbers or identifiers
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.2 | $0-$5k | 6.59 |
Summary
A vulnerability classified as problematic was found in Zoho ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus. This impacts an unknown function. The manipulation results in generation of predictable numbers or identifiers. This vulnerability is identified as CVE-2026-11374. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.
Details
A vulnerability was found in Zoho ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus (version unknown). It has been classified as problematic. Affected is an unknown function. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. CWE is classifying the issue as CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
The advisory is shared for download at manageengine.com. This vulnerability is traded as CVE-2026-11374 since 06/05/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.
Upgrading eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38423). Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
License
Website
- Vendor: https://www.manageengine.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.3VulDB Meta Temp Score: 7.2
VulDB Base Score: 5.6
VulDB Temp Score: 5.4
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 9.0
CNA Vector (Zohocorp): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Generation of predictable numbers or identifiersCWE: CWE-340 / CWE-331 / CWE-330
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Timeline
06/05/2026 CVE reserved06/23/2026 Advisory disclosed
06/23/2026 VulDB entry created
06/23/2026 VulDB entry last update
Sources
Vendor: manageengine.comAdvisory: manageengine.com
Status: Confirmed
CVE: CVE-2026-11374 (🔒)
GCVE (CVE): GCVE-0-2026-11374
GCVE (VulDB): GCVE-100-372876
EUVD: 🔒
Entry
Created: 06/23/2026 11:54Updated: 06/23/2026 14:40
Changes: 06/23/2026 11:54 (60), 06/23/2026 14:40 (1)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.