CVE-2026-11374: Predictable SSO Ticket Generation Enables Unauthenticated Account Takeover in ManageEngine AD360 Products — Threadlinqs Intelligence
As of 2026-07-22, CVE-2026-11374: Predictable SSO Ticket Generation Enables Unauthenticated Account Takeover in ManageEngine AD360 Products is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-1627 · Severity: CRITICAL · CVSS: 9 · Status: PATCHED · Category: VULNERABILITY
ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus generate SSO ticket IDs from raw System.currentTimeMillis() timestamps instead of cryptographically random
CVE-2026-11374 is a predictable-token vulnerability in the SSO cookie-based authentication flow shared by four ManageEngine products (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) when integrated with ManageEngine AD360. The affected CookieSSOImpl handler generates the CUSTOM_SSO_TICKET value directly from the server's System.currentTimeMillis() call via the pattern `Long time = Long.valueOf(System.currentTimeMillis()); String ticketId = time.toString();`, producing a 13-digit decimal timestamp string with no cryptographic randomness, HMAC, or nonce mixed in. TicketHandler.getTicket() resolves the guessed ticket string against a server-side cache keyed by that timestamp, mapping to a Ticket object containing the resolved user ID, login name, assigned roles, domain, and the source IP recorded at issuance.
An attacker who can reach the login endpoint of an AD360-integrated product (typically `*.do` URLs such as `/AppsHome.do`, or `/showLogin.cc`) can enumerate the narrow window of plausible millisecond timestamps around a known or observed login event and submit candidate CUSTOM_SSO_TICKET / CUSTOM_SSO_APP_TAG_NAME / CUSTOM_SSO_APP_NAME cookie triples to the protected endpoint. CookieSSOImpl validates the guessed ticket via TicketHandler.getTicket(); on a match it drives `/adsf/jsp/common/LoginFormSubmit.jsp` to return an auto-submitting HTML login form pre-populated with the victim's username. That form is then POSTed to `/j_security_check` (the servlet-container form-authentication endpoint), processed by CustomSSOAuthHandler, and results in an authenticated session under the victim's identity — without ever supplying a password.
Three layered controls make blind, remote, internet-scale exploitation impractical despite the CVSS 9.0 base score: (1) a server-to-server handshake on the GET_SSO_TICKET_DETAILS resolver requiring a random UUID handshake key that rotates every 120 seconds, closing off a direct timestamp-oracle attack; (2) source-IP binding keyed on the raw socket address (not the spoofable X-Forwarded-For header, in default configuration, though a misconfigured TRUSTED_IPS setting could reintroduce spoofing risk); and (3) IAM security-filter request throttling (the IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED control) capping roughly 40 requests per 60 seconds per request-path-plus-source-IP, with a further 60-second lockout on violation. These combine to require an attacker to already share an IP/NAT boundary or have a foothold on the victim's internal network, to predict the login timing within roughly a one-second window, and to sustain a throttled guessing campaign of around 25 minutes while the legitimate ticket remains cached — a noisy, slow, and log-visible attack rather than a mass unauthenticated internet exploit.
Bishop Fox's companion open-source detection tool (CVE-2026-11374-check, Python) confirms the AD360-integration precondition remotely and unauthenticated by sending a deliberately invalid CUSTOM_SSO_TICKET=1700000000000 cookie paired with CUSTOM_SSO_APP_TAG_NAME=AD360 to a CustomSSO URL pattern and inspecting the response for cookie-cleanup Set-Cookie headers (CUSTOM_SSO_TICKET=removed, CUSTOM_SSO_APP_NAME=removed, CUSTOM_SSO_APP_TAG_NAME=removed with Max-Age=0), cross-referenced against product-specific Tomcat session-cookie names (JSESSIONIDADSSP, JSESSIONIDADAP, JSESSIONIDM365MP, JSESSIONIDRMP) and build-number query parameters (?build= for ADSelfService Plus, ?v= for ADAudit Plus, ?bN= for M365 Manager Plus; RecoveryManager Plus exposes none). Default product ports are 8888 (ADSelfService Plus), 8081 (ADAudit Plus), 8365 (M365 Manager Plus), and 8090 (RecoveryManager Plus).
The issue was privately reported by security researcher 0xmanhnv through the Zoho BugBounty program. Zoho/ManageEngine's patched code replaces the timestamp-derived ticket with `String ticketId = UUID.randomUUID().toString();`, providing roughly 122 bits of SecureRandom entropy
Weaknesses (CWE)
CWE-330, CWE-613, CWE-384
Target sectors: enterprise it, identity and access management, government administration, finance, health, education, managed service providers
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-11374, T1595.002, T1592.002, T1589, T1133, T1190, T1539, T1606, T1110, T1110.004, T1550.004