CVE-2026-11374: Predictable SSO Ticket Generation Enables Unauthenticated Account Takeover in ManageEngine AD360 Products
CVE-2026-11374 (TL-2026-1627) is a critical-severity software vulnerability scored CVSS 9, first published 2026-07-22. It has no confirmed attribution, affects Zoho / ManageEngine ADSelfService Plus, references 1 CVE (CVE-2026-11374), maps to 16 MITRE ATT&CK techniques (T1069, T1078.002, T1087), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1627
- Threat ID
- TL-2026-1627
- Severity
- CRITICAL
- CVSS
- 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise it, identity and access management, government administration, finance, health, education, managed service providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in CVE-2026-11374
Malware and tooling: CVE-2026-11374-check
ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus generate SSO ticket IDs from raw System.currentTimeMillis() timestamps instead of cryptographically random values, allowing an attacker positioned on the victim's network to predict and replay valid CUSTOM_SSO_TICKET cookies for unauthenticated account takeover. Bishop Fox validated full exploitation in a lab environment but found layered controls (server-to-server handshake, source-IP binding, request throttling) constrain practical exploitation to attackers already on the target's network segment.
How CVE-2026-11374 works
CVE-2026-11374 is a predictable-token vulnerability in the SSO cookie-based authentication flow shared by four ManageEngine products (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) when integrated with ManageEngine AD360. The affected CookieSSOImpl handler generates the CUSTOM_SSO_TICKET value directly from the server's System.currentTimeMillis() call via the pattern `Long time = Long.valueOf(System.currentTimeMillis()); String ticketId = time.toString();`, producing a 13-digit decimal timestamp string with no cryptographic randomness, HMAC, or nonce mixed in. TicketHandler.getTicket() resolves the guessed ticket string against a server-side cache keyed by that timestamp, mapping to a Ticket object containing the resolved user ID, login name, assigned roles, domain, and the source IP recorded at issuance.
An attacker who can reach the login endpoint of an AD360-integrated product (typically `*.do` URLs such as `/AppsHome.do`, or `/showLogin.cc`) can enumerate the narrow window of plausible millisecond timestamps around a known or observed login event and submit candidate CUSTOM_SSO_TICKET / CUSTOM_SSO_APP_TAG_NAME / CUSTOM_SSO_APP_NAME cookie triples to the protected endpoint. CookieSSOImpl validates the guessed ticket via TicketHandler.getTicket(); on a match it drives `/adsf/jsp/common/LoginFormSubmit.jsp` to return an auto-submitting HTML login form pre-populated with the victim's username. That form is then POSTed to `/j_security_check` (the servlet-container form-authentication endpoint), processed by CustomSSOAuthHandler, and results in an authenticated session under the victim's identity — without ever supplying a password.
Three layered controls make blind, remote, internet-scale exploitation impractical despite the CVSS 9.0 base score: (1) a server-to-server handshake on the GET_SSO_TICKET_DETAILS resolver requiring a random UUID handshake key that rotates every 120 seconds, closing off a direct timestamp-oracle attack; (2) source-IP binding keyed on the raw socket address (not the spoofable X-Forwarded-For header, in default configuration, though a misconfigured TRUSTED_IPS setting could reintroduce spoofing risk); and (3) IAM security-filter request throttling (the IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED control) capping roughly 40 requests per 60 seconds per request-path-plus-source-IP, with a further 60-second lockout on violation. These combine to require an attacker to already share an IP/NAT boundary or have a foothold on the victim's internal network, to predict the login timing within roughly a one-second window, and to sustain a throttled guessing campaign of around 25 minutes while the legitimate ticket remains cached — a noisy, slow, and log-visible attack rather than a mass unauthenticated internet exploit.
Bishop Fox's companion open-source detection tool (CVE-2026-11374-check, Python) confirms the AD360-integration precondition remotely and unauthenticated by sending a deliberately invalid CUSTOM_SSO_TICKET=1700000000000 cookie paired with CUSTOM_SSO_APP_TAG_NAME=AD360 to a CustomSSO URL pattern and inspecting the response for cookie-cleanup Set-Cookie headers (CUSTOM_SSO_TICKET=removed, CUSTOM_SSO_APP_NAME=removed, CUSTOM_SSO_APP_TAG_NAME=removed with Max-Age=0), cross-referenced against product-specific Tomcat session-cookie names (JSESSIONIDADSSP, JSESSIONIDADAP, JSESSIONIDM365MP, JSESSIONIDRMP) and build-number query parameters (?build= for ADSelfService Plus, ?v= for ADAudit Plus, ?bN= for M365 Manager Plus; RecoveryManager Plus exposes none). Default product ports are 8888 (ADSelfService Plus), 8081 (ADAudit Plus), 8365 (M365 Manager Plus), and 8090 (RecoveryManager Plus).
The issue was privately reported by security researcher 0xmanhnv through the Zoho BugBounty program. Zoho/ManageEngine's patched code replaces the timestamp-derived ticket with `String ticketId = UUID.randomUUID().toString();`, providing roughly 122 bits of SecureRandom entropy, and shipped fixes across the four affected products between June 3 and June 12, 2026 (ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, ADAudit Plus 8703). Bishop Fox published an independent technical analysis and the detection/precondition-check tool on July 21, 2026, confirming end-to-end exploitability in a controlled lab while cautioning defenders that the realistic risk profile is a targeted, network-positioned attacker rather than opportunistic mass scanning. No confirmed in-the-wild exploitation has been reported as of this analysis.
MITRE ATT&CK techniques used in TL-2026-1627
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1518 Software Discovery
Privilege Escalation
Credential Access
T1110 Brute Force; T1110.004 Credential Stuffing; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Collection
T1213 Data from Information Repositories
lateral-movement
Reconnaissance
T1589 Gather Victim Identity Information; T1592.002 Software; T1595.002 Vulnerability Scanning
Affected products and versions in CVE-2026-11374
- Zoho / ManageEngine — ADSelfService Plus
Vulnerable versions: 6528 and earlier
Fixed in: 6529 - Zoho / ManageEngine — RecoveryManager Plus
Vulnerable versions: 6320 and earlier
Fixed in: 6321 - Zoho / ManageEngine — M365 Manager Plus
Vulnerable versions: 4816 and earlier
Fixed in: 4817 - Zoho / ManageEngine — ADAudit Plus
Vulnerable versions: 8702 and earlier
Fixed in: 8703 - Zoho / ManageEngine — AD360
Vulnerable versions: all versions providing SSO integration to the four affected products
Fixed in: N/A - fix delivered in integrated product builds
Remediation for CVE-2026-11374
Patches
- ADSelfService Plus build 6529 (June 3, 2026)
- RecoveryManager Plus build 6321 (June 5, 2026)
- M365 Manager Plus build 4817 (June 10, 2026)
- ADAudit Plus build 8703 (June 12, 2026)
Immediate actions
- Upgrade ADSelfService Plus to build 6529 or later
- Upgrade RecoveryManager Plus to build 6321 or later
- Upgrade M365 Manager Plus to build 4817 or later
- Upgrade ADAudit Plus to build 8703 or later
- Run the Bishop Fox CVE-2026-11374-check tool (--json / --brief) to confirm AD360-integration exposure precondition before patching windows
- Review authentication and SSO logs for CUSTOM_SSO_TICKET replay attempts and unexplained /adsf/jsp/common/LoginFormSubmit.jsp form auto-submissions
- Search server logs (serverOut_<date>.txt) for IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED entries against /showLogin.cc
Workarounds
- Disable AD360 SSO integration for the affected product until patched, forcing direct/local authentication
- Enforce strict source-IP allowlisting on SSO login endpoints as a compensating control pre-patch
Longer-term hardening
- Restrict network reachability to AD360-integrated login/SSO endpoints to trusted internal segments only
- Deploy egress/ingress network segmentation to reduce shared-NAT/internal-foothold exposure to SSO endpoints
- Enable enhanced authentication logging and alerting on URL_ROLLING_THROTTLES_LIMIT_EXCEEDED events
- Audit TRUSTED_IPS configuration to ensure X-Forwarded-For based IP binding is not enabled, which would reintroduce spoofing risk
- Adopt cryptographically random, HMAC-bound session/ticket identifiers in custom SSO integrations generally
CVEs associated with CVE-2026-11374
Weaknesses (CWE) in CVE-2026-11374
CWE-330, CWE-613, CWE-384
Timeline of CVE-2026-11374
- Security researcher 0xmanhnv privately reports predictable SSO ticket generation flaw to Zoho via the Zoho BugBounty program
- ADSelfService Plus build 6529 released, fixing predictable SSO ticket generation by replacing the timestamp string with UUID.randomUUID()
- RecoveryManager Plus build 6321 released with the same SSO ticket fix
- M365 Manager Plus build 4817 released with the same SSO ticket fix
- ADAudit Plus build 8703 released, completing the patch rollout across all four affected products; ManageEngine publishes the vendor advisory
- Vulnerability included in HawkEye Weekly Threat Landscape Digest coverage of Week 25 2026 disclosures
- Multiple security news outlets (GBHackers, CyberPress, Cybersecurity News, Heise, Cryptika) publish coverage summarizing the Bishop Fox analysis
- Bishop Fox publishes full technical analysis blog post 'A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit' along with the CVE-2026-11374-check Python detection/precondition-check tool on GitHub
Sources cited for CVE-2026-11374
- A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
- CVE-2026-11374 detection tool (BishopFox)
- CVE-2026-11374: Account takeover vulnerability in ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus
- ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability
- ManageEngine AD360 Flaw Lets Unauthenticated Attackers Take Over User Accounts
- ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers
- CVE-2026-11374 - Account Takeover via Predictable SSO Ticket Generation
- Zoho Corp. ManageEngine: Critical SSO vulnerability allows account takeover
- ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers
- Weekly Threat Landscape Digest - Week 25
Threats related to CVE-2026-11374
- CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)
- CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation
- Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
- SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained With Appliance Management Console Command Injection (CVE-2026-15410, CVSS 7.2) Under Active Zero-Day Exploitation
- Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
- CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Unpatched Chain Component, PoC Public)
Detection coverage for TL-2026-1627
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1627 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.