CVE-2026-11374 is a critical unauthenticated account takeover affecting ManageEngine's ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when integrated under AD360. The root cause: the SSO ticket is just System.currentTimeMillis() at login, written unencoded into the CUSTOM_SSO_TICKET cookie, so an attacker who predicts the millisecond can replay it as a valid session cookie. Despite a CVSS 9.0 rating, exploitation is hard in practice because three layered controls compound: a server-to-server handshake key closes off the fast oracle endpoint, ticket resolution is bound to the victim's own client IP so brute force cannot be parallelized across sources, and a rolling request throttle caps guessing at roughly 40 requests per 60 seconds. Together these mean the realistic attacker must already have a network vantage point on the victim, not an opportunistic internet scanner. The vendor patch (ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, ADAudit Plus 8703) replaces the timestamp with a random UUID (122 bits of entropy), closing the prediction vector, but the SSO ticket remains a long-lived, non-HttpOnly bearer token, so a stolen ticket still works on patched hosts. Bishop Fox published a free GitHub detection tool that safely identifies which AD360-integrated instances expose the vulnerable cookie-replay path without needing a valid ticket.
Table of contents
SummaryDefender Action ItemsBackgroundThe Vulnerability: An SSO Ticket That’s Just a TimestampWhy Brute Force is ImpracticalSafe DetectionConclusionQuestions this post answers
What is CVE-2026-11374 and which ManageEngine products does it affect?
CVE-2026-11374 is a critical unauthenticated account takeover in ManageEngine's AD360-integrated products, where the SSO ticket is simply the millisecond timestamp at login rather than a random value, letting an attacker who predicts that instant replay it as a session cookie. It affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, scoring CVSS 9.0 (Critical) per the vendor. Teams running ManageEngine AD360 track vulnerability writeups like this one on daily.dev before patching decisions.
Which build versions fix CVE-2026-11374 in ManageEngine products?
The fix ships in ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, and ADAudit Plus 8703 or later. These builds replace the predictable millisecond-timestamp SSO ticket with a random UUID backed by SecureRandom, providing 122 bits of entropy instead of a guessable clock value, closing the unauthenticated prediction vector. daily.dev helps admins stay on top of patch-version details like these before a fleet-wide rollout.
Why is CVE-2026-11374 hard to exploit despite being rated critical severity?
Three independent controls compound to block practical exploitation: a server-to-server handshake key rotated every 120 seconds closes off the fast ticket-resolution oracle, ticket validation is bound to the victim's own client IP so guesses can't be parallelized across sources, and a rolling throttle caps requests at about 40 per 60 seconds. Together these force an attacker to already have network access to the victim rather than scan opportunistically. Readers weighing real-world exploit risk versus CVSS scores follow analyses like this on daily.dev.