ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability

Gbhackers •Divya • June 25, 2026

ManageEngine has disclosed a critical account takeover vulnerability, tracked as CVE-2026-11374, affecting various integrated products within its AD360 identity and access management suite. The flaw affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when used with AD360 and via single sign-on (SSO) integration. This vulnerability stems from predictable SSO ticket generation, which […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSO Vulnerability in ManageEngine Allows Account Takeover Zoho Corp. ManageEngine has disclosed a critical vulnerability tracked as CVE-2026-11374, affecting several of its products when integrated with AD360. The flaw allows attackers to predict single sign-on (SSO) tokens, potentially leading to account takeover and exposure of sensitive user information. Affected products include ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, with specific vulnerable versions listed. The vulnerability has a CVSS score of 9.0, indicating a critical risk. As of now, there are no confirmed reports of exploitation in the wild. Users are advised to update to the latest versions to mitigate the risk. The vulnerability was reported through the Zoho bug bounty program. This follows previous disclosures of critical vulnerabilities in ManageEngine products last November. 3 sources 73

Extracted Entities

ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)