ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers

Cybersecuritynews •Abinaya • June 25, 2026

ManageEngine has disclosed a high-severity vulnerability, tracked as CVE-2026-11374, affecting several of its identity and access management solutions when integrated with AD360. The flaw could allow unauthenticated attackers to predict single sign-on (SSO) tokens, potentially leading to account takeover and exposure of sensitive user information. The issue affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSO Vulnerability in ManageEngine Allows Account Takeover Zoho Corp. ManageEngine has disclosed a critical vulnerability tracked as CVE-2026-11374, affecting several of its products when integrated with AD360. The flaw allows attackers to predict single sign-on (SSO) tokens, potentially leading to account takeover and exposure of sensitive user information. Affected products include ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, with specific vulnerable versions listed. The vulnerability has a CVSS score of 9.0, indicating a critical risk. As of now, there are no confirmed reports of exploitation in the wild. Users are advised to update to the latest versions to mitigate the risk. The vulnerability was reported through the Zoho bug bounty program. This follows previous disclosures of critical vulnerabilities in ManageEngine products last November. 3 sources 73

Extracted Entities

ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (4)