Zoho Corp. ManageEngine: Critical SSO vulnerability allows account takeover

Several Zoho Corp. ManageEngine products are vulnerable to a flaw that comes with the single sign-on (SSO) integration. Attackers could thereby take over accounts.

This is reported by Zoho Corp. ManageEngine in a security advisory . If users log in to ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, or ADAudit Plus using SSO and these products are integrated within ManageEngine AD360, the problem can occur. The created SSO tickets, which authenticate the sessions, can be predicted by attackers, allowing them to take over accounts ( CVE-2026-11374 , CVSS 9.0 , Risk " critical ").

According to the information, ADSelfService Plus up to and including Build 6528, RecoveryManager Plus up to and including 6320, M365 Manager Plus up to and including 4816, and ADAudit Plus up to and including 8702 are affected. Versions ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, and ADAudit Plus 8703, as well as newer packages, close this security vulnerability.

Zohocorp provides the updates as a service pack for download. These are available for each of the affected products:

The security vulnerability does not appear to be exploited in the wild yet; the authors of the advisory do not write this. The vulnerability was reported to the manufacturer by an IT researcher with the handle 0xmanhnv via the Zoho bug bounty program.

Last November, several partly critical security vulnerabilities in various Zohocorp ManageEngine products became known. Attackers could, for example, inject SQL commands due to an SQL injection vulnerability or generally inject commands.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.