Skip to navigation

Threat reportVulnerabilityTL-2026-1627

CVE-2026-11374: Predictable SSO Ticket Generation Enables Unauthenticated Account Takeover in ManageEngine AD360 Products

criticalPATCHED

ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus generate SSO ticket IDs from raw System.currentTimeMillis() timestamps instead of cryptographically random values, allowing an attacker positioned on the victim's network to predict and replay valid CUSTOM_SSO_TICKET cookies for unauthenticated account takeover.

Key facts for ManageEngine AD360 predictable SSO

IdentifiersTL-2026-1627, CVE-2026-11374
SeverityCRITICAL
CVSS9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2026-11374: 1.9% (78.2th percentile)
Affected productsZoho / ManageEngine ADSelfService Plus; Zoho / ManageEngine RecoveryManager Plus; Zoho / ManageEngine M365 Manager Plus; Zoho / ManageEngine ADAudit Plus; Zoho / ManageEngine AD360
Weaknesses (CWE)CWE-330, CWE-613, CWE-384
ToolsCVE-2026-11374-check
MITRE ATT&CK techniquesT1069 Permission Groups Discovery, T1078.002 Domain Accounts, T1087 Account Discovery, T1110 Brute Force, T1110.004 Credential Stuffing, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1210 Exploitation of Remote Services, T1213 Data from Information Repositories, T1518 Software Discovery, T1539 Steal Web Session Cookie, T1550.004 Web Session Cookie and 4 more in the attack flow
MotivationUNKNOWN
Target sectorsenterprise it, identity and access management, government administration, finance, health, education, managed service providers
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for ManageEngine AD360 predictable SSO

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1627 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-11374 — CUSTOM_SSO_TICKET Millisecond-Window Cookie Enumeration

Detects a single source IP sending a burst of GET requests to AD360-integrated *.do / showLogin.cc endpoints carrying CUSTOM_SSO_TICKET cookie values that differ only in low-order milliseconds within a ~1 second window — the observable footprint of predictable-token guessing against CookieSSOImpl/TicketHandler.getTicket() (CWE-330 insufficient randomness).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1539, T1110
  • Data sources: manageengine_access_log, web_proxy, load_balancer_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web_proxy sourcetype="manageengine:access" (uri_path="*/AppsHome.do*" OR uri_path="*/showLogin.cc*")
| rex field=cookie "CUSTOM_SSO_TICKET=(?<ticket_id>\d{13})"
| where isnotnull(ticket_id)
| eval ticket_ms=ticket_id
| bucket _time span=1s
| stats count as ticket_attempts, dc(ticket_ms) as distinct_tickets, min(ticket_ms) as min_ticket, max(ticket_ms) as max_ticket by src_ip, _time
| eval ticket_spread_ms = max_ticket - min_ticket
| where ticket_attempts > 10 AND ticket_spread_ms <= 1000
| sort - ticket_attempts

Microsoft KQL

let lookback = 24h;
WebRequests_CL
| where TimeGenerated > ago(lookback)
| where RequestPath_s has_any ("/AppsHome.do", "/showLogin.cc")
| extend ticket_id = extract(@"CUSTOM_SSO_TICKET=(\d{13})", 1, tostring(Cookie_s))
| where isnotempty(ticket_id)
| summarize TicketAttempts = count(), DistinctTickets = dcount(ticket_id), MinTicket = min(toint(ticket_id)), MaxTicket = max(toint(ticket_id)) by SourceIP_s, bin(TimeGenerated, 1s)
| extend TicketSpreadMs = MaxTicket - MinTicket
| where TicketAttempts > 10 and TicketSpreadMs <= 1000
| project TimeGenerated, SourceIP_s, TicketAttempts, DistinctTickets, TicketSpreadMs

Sigma

title: CUSTOM_SSO_TICKET Rapid Millisecond-Window Cookie Enumeration
id: 3c7d9f21-4e8a-4b1c-9a2f-6e0d3b8c5a17
status: experimental
description: Detects a burst of CUSTOM_SSO_TICKET cookie values from a single source IP that differ only in low-order milliseconds, consistent with ticket-timestamp guessing against CVE-2026-11374 (predictable SSO ticket generation in ManageEngine AD360-integrated products).
references:
    - https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit
    - https://github.com/BishopFox/CVE-2026-11374-check
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.credential-access
    - attack.t1539
    - attack.t1110
    - attack.initial-access
    - attack.t1190
    - cve.2026.11374
logsource:
    category: webserver
    product: manageengine
detection:
    selection:
        cs_cookie|contains: 'CUSTOM_SSO_TICKET='
        request_path|contains:
            - '/AppsHome.do'
            - '/showLogin.cc'
    timeframe: 1s
    condition: selection | count(cs_cookie) by src_ip > 10
falsepositives:
    - Load balancer or WAF health probes replaying stale session cookies
    - Authorized use of the Bishop Fox CVE-2026-11374-check precondition-check tool
level: high

Known false positives:

  • Load balancer or CDN health checks replaying stale/cached session cookies at high frequency
  • Authorized internal use of the Bishop Fox CVE-2026-11374-check scanning tool during a patching-window audit

Tuning notes: Tune the count>10 / 1s-window thresholds to the environment's normal SSO retry rate; exclude known vulnerability-scanner source IPs (e.g. an internal Bishop Fox CVE-2026-11374-check runner) via an allowlist macro rather than disabling the rule.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CVE-2026-11374 — Bishop Fox Canary-Cookie Precondition-Check Probe · unlock with TL Creds
  • CVE-2026-11374 — Post-Takeover Identity, Role, and Domain Disclosure via Discovery Requests · unlock with TL Creds
  • CVE-2026-11374 — [indicator] · unlock with TL Creds
  • CVE-2026-11374 — IAMSecurityException Throttle-Limit Violation on SSO Endpoints · unlock with TL Creds
  • CVE-2026-11374 — Build-Number Fingerprinting of AD360-Integrated Products by Unauthenticated Source · unlock with TL Creds
  • CVE-2026-11374 — Successful 401-then-200 CUSTOM_SSO_TICKET Sequence Establishing an Authenticated Session · unlock with TL Creds
  • CVE-2026-11374 — Post-Guess Auto-Submit Form Retrieval Immediately Followed by j_security_check POST · unlock with TL Creds
  • CVE-2026-11374 — Source-IP-Binding Bypass via Spoofed X-Forwarded-For on SSO Endpoints · unlock with TL Creds

Indicators of compromise for ManageEngine AD360 predictable SSO

As of 2026-07-22, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-1627.

19 indicators of compromise · unlock with TL Creds. Compare plans

How ManageEngine AD360 predictable SSO works

Bishop Fox validated full exploitation in a lab environment but found layered controls (server-to-server handshake, source-IP binding, request throttling) constrain practical exploitation to attackers already on the target's network segment.

CVE-2026-11374 is a predictable-token vulnerability in the SSO cookie-based authentication flow shared by four ManageEngine products (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) when integrated with ManageEngine AD360. The affected CookieSSOImpl handler generates the CUSTOM_SSO_TICKET value directly from the server's System.currentTimeMillis() call via the pattern `Long time = Long.valueOf(System.currentTimeMillis()); String ticketId = time.toString();`, producing a 13-digit decimal timestamp string with no cryptographic randomness, HMAC, or nonce mixed in. TicketHandler.getTicket() resolves the guessed ticket string against a server-side cache keyed by that timestamp, mapping to a Ticket object containing the resolved user ID, login name, assigned roles, domain, and the source IP recorded at issuance.

An attacker who can reach the login endpoint of an AD360-integrated product (typically `*.do` URLs such as `/AppsHome.do`, or `/showLogin.cc`) can enumerate the narrow window of plausible millisecond timestamps around a known or observed login event and submit candidate CUSTOM_SSO_TICKET / CUSTOM_SSO_APP_TAG_NAME / CUSTOM_SSO_APP_NAME cookie triples to the protected endpoint. CookieSSOImpl validates the guessed ticket via TicketHandler.getTicket(); on a match it drives `/adsf/jsp/common/LoginFormSubmit.jsp` to return an auto-submitting HTML login form pre-populated with the victim's username. That form is then POSTed to `/j_security_check` (the servlet-container form-authentication endpoint), processed by CustomSSOAuthHandler, and results in an authenticated session under the victim's identity — without ever supplying a password.

Three layered controls make blind, remote, internet-scale exploitation impractical despite the CVSS 9.0 base score: (1) a server-to-server handshake on the GET_SSO_TICKET_DETAILS resolver requiring a random UUID handshake key that rotates every 120 seconds, closing off a direct timestamp-oracle attack; (2) source-IP binding keyed on the raw socket address (not the spoofable X-Forwarded-For header, in default configuration, though a misconfigured TRUSTED_IPS setting could reintroduce spoofing risk); and (3) IAM security-filter request throttling (the IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED control) capping roughly 40 requests per 60 seconds per request-path-plus-source-IP, with a further 60-second lockout on violation. These combine to require an attacker to already share an IP/NAT boundary or have a foothold on the victim's internal network, to predict the login timing within roughly a one-second window, and to sustain a throttled guessing campaign of around 25 minutes while the legitimate ticket remains cached — a noisy, slow, and log-visible attack rather than a mass unauthenticated internet exploit.

Bishop Fox's companion open-source detection tool (CVE-2026-11374-check, Python) confirms the AD360-integration precondition remotely and unauthenticated by sending a deliberately invalid CUSTOM_SSO_TICKET=1700000000000 cookie paired with CUSTOM_SSO_APP_TAG_NAME=AD360 to a CustomSSO URL pattern and inspecting the response for cookie-cleanup Set-Cookie headers (CUSTOM_SSO_TICKET=removed, CUSTOM_SSO_APP_NAME=removed, CUSTOM_SSO_APP_TAG_NAME=removed with Max-Age=0), cross-referenced against product-specific Tomcat session-cookie names (JSESSIONIDADSSP, JSESSIONIDADAP, JSESSIONIDM365MP, JSESSIONIDRMP) and build-number query parameters (?build= for ADSelfService Plus, ?v= for ADAudit Plus, ?bN= for M365 Manager Plus; RecoveryManager Plus exposes none). Default product ports are 8888 (ADSelfService Plus), 8081 (ADAudit Plus), 8365 (M365 Manager Plus), and 8090 (RecoveryManager Plus).

The issue was privately reported by security researcher 0xmanhnv through the Zoho BugBounty program. Zoho/ManageEngine's patched code replaces the timestamp-derived ticket with `String ticketId = UUID.randomUUID().toString();`, providing roughly 122 bits of SecureRandom entropy, and shipped fixes across the four affected products between June 3 and June 12, 2026 (ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, ADAudit Plus 8703). Bishop Fox published an independent technical analysis and the detection/precondition-check tool on July 21, 2026, confirming end-to-end exploitability in a controlled lab while cautioning defenders that the realistic risk profile is a targeted, network-positioned attacker rather than opportunistic mass scanning. No confirmed in-the-wild exploitation has been reported as of this analysis.

MITRE ATT&CK techniques by tactic:

Discovery

T1069 Permission Groups Discovery; T1087 Account Discovery; T1518 Software Discovery

Privilege Escalation

T1078.002 Domain Accounts

Credential Access

T1110 Brute Force; T1110.004 Credential Stuffing; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Collection

T1213 Data from Information Repositories

lateral-movement

T1550.004 Web Session Cookie

Reconnaissance

T1589 Gather Victim Identity Information; T1592.002 Software; T1595.002 Vulnerability Scanning

Remediation for ManageEngine AD360 predictable SSO

Patches

  • ADSelfService Plus build 6529 (June 3, 2026)
  • RecoveryManager Plus build 6321 (June 5, 2026)
  • M365 Manager Plus build 4817 (June 10, 2026)
  • ADAudit Plus build 8703 (June 12, 2026)

Immediate actions

  • Upgrade ADSelfService Plus to build 6529 or later
  • Upgrade RecoveryManager Plus to build 6321 or later
  • Upgrade M365 Manager Plus to build 4817 or later
  • Upgrade ADAudit Plus to build 8703 or later
  • Run the Bishop Fox CVE-2026-11374-check tool (--json / --brief) to confirm AD360-integration exposure precondition before patching windows
  • Review authentication and SSO logs for CUSTOM_SSO_TICKET replay attempts and unexplained /adsf/jsp/common/LoginFormSubmit.jsp form auto-submissions
  • Search server logs (serverOut_<date>.txt) for IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED entries against /showLogin.cc

Workarounds

  • Disable AD360 SSO integration for the affected product until patched, forcing direct/local authentication
  • Enforce strict source-IP allowlisting on SSO login endpoints as a compensating control pre-patch

Longer-term hardening

  • Restrict network reachability to AD360-integrated login/SSO endpoints to trusted internal segments only
  • Deploy egress/ingress network segmentation to reduce shared-NAT/internal-foothold exposure to SSO endpoints
  • Enable enhanced authentication logging and alerting on URL_ROLLING_THROTTLES_LIMIT_EXCEEDED events
  • Audit TRUSTED_IPS configuration to ensure X-Forwarded-For based IP binding is not enabled, which would reintroduce spoofing risk
  • Adopt cryptographically random, HMAC-bound session/ticket identifiers in custom SSO integrations generally

Affected and fixed versions

  • Zoho / ManageEngine — ADSelfService Plus
    Vulnerable versions: 6528 and earlier
    Fixed in: 6529
  • Zoho / ManageEngine — RecoveryManager Plus
    Vulnerable versions: 6320 and earlier
    Fixed in: 6321
  • Zoho / ManageEngine — M365 Manager Plus
    Vulnerable versions: 4816 and earlier
    Fixed in: 4817
  • Zoho / ManageEngine — ADAudit Plus
    Vulnerable versions: 8702 and earlier
    Fixed in: 8703
  • Zoho / ManageEngine — AD360
    Vulnerable versions: all versions providing SSO integration to the four affected products
    Fixed in: N/A - fix delivered in integrated product builds

Timeline of ManageEngine AD360 predictable SSO

  • Security researcher locked-ioc-19 privately reports predictable SSO ticket generation flaw to Zoho via the Zoho BugBounty program
  • ADSelfService Plus build 6529 released, fixing predictable SSO ticket generation by replacing the timestamp string with UUID.randomUUID()
  • RecoveryManager Plus build 6321 released with the same SSO ticket fix
  • M365 Manager Plus build 4817 released with the same SSO ticket fix
  • ADAudit Plus build 8703 released, completing the patch rollout across all four affected products; ManageEngine publishes the vendor advisory
  • Vulnerability included in HawkEye Weekly Threat Landscape Digest coverage of Week 25 2026 disclosures
  • Multiple security news outlets (GBHackers, CyberPress, Cybersecurity News, Heise, Cryptika) publish coverage summarizing the Bishop Fox analysis
  • Bishop Fox publishes full technical analysis blog post 'A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit' along with the locked-ioc-15 Python detection/precondition-check tool on GitHub

Sources cited for ManageEngine AD360 predictable SSO

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats