AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-11374

CRITICAL · CVSS 9 EPSS 1.96%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-06-23 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.0. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-11374
Severity
CRITICAL
CVSS
9
EPSS
1.96%

Original NVD Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.