PT-2026-51487 · Zohocorp · Zoho Manageengine Adaudit Plus+3

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-11374

Mitre

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Correção

Use of Insufficiently Random Values

Improper Authentication

Enumeração de Fraquezas

CWE-330

CWE-287

CWE-340

Identificadores relacionados

CVE-2026-11374

Produtos afetados

Zoho Manageengine Adaudit Plus

Zoho Manageengine Adselfservice Plus

Zoho Manageengine M365 Manager Plus

Zoho Manageengine Recovery Manager Plus

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-11374 · Nota de Segurança
• https://manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html · Nota