# CVE-2026-11374: Predictable SSO Ticket Generation Enables Unauthenticated Account Takeover in ManageEngine AD360 Products

> ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus generate SSO ticket IDs from raw System.currentTimeMillis() timestamps instead of cryptographically random values, allowing an attacker positioned on the victim's network to predict and replay valid CUSTOM_SSO_TICKET cookies for unauthenticated account takeover. Bishop Fox validated full exploitation in a lab environment but found layered controls (server-to-server handshake, source-IP binding, request throttling) constrain practical exploitation to attackers already on the target's network segment.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1627
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-manageengine-ad360-predictable-sso-tl-2026-1627.webp?v=312008aa (Threadlinqs threat intel: CVE-2026-11374 ManageEngine AD360 SSO: Detection & IOCs (TL-2026-1627) — Critical severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-1627
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 19
- **CVEs:** CVE-2026-11374

## Description

CVE-2026-11374 is a predictable-token vulnerability in the SSO cookie-based authentication flow shared by four ManageEngine products (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) when integrated with ManageEngine AD360. The affected CookieSSOImpl handler generates the CUSTOM_SSO_TICKET value directly from the server's System.currentTimeMillis() call via the pattern `Long time = Long.valueOf(System.currentTimeMillis()); String ticketId = time.toString();`, producing a 13-digit decimal timestamp string with no cryptographic randomness, HMAC, or nonce mixed in. TicketHandler.getTicket() resolves the guessed ticket string against a server-side cache keyed by that timestamp, mapping to a Ticket object containing the resolved user ID, login name, assigned roles, domain, and the source IP recorded at issuance.

An attacker who can reach the login endpoint of an AD360-integrated product (typically `*.do` URLs such as `/AppsHome.do`, or `/showLogin.cc`) can enumerate the narrow window of plausible millisecond timestamps around a known or observed login event and submit candidate CUSTOM_SSO_TICKET / CUSTOM_SSO_APP_TAG_NAME / CUSTOM_SSO_APP_NAME cookie triples to the protected endpoint. CookieSSOImpl validates the guessed ticket via TicketHandler.getTicket(); on a match it drives `/adsf/jsp/common/LoginFormSubmit.jsp` to return an auto-submitting HTML login form pre-populated with the victim's username. That form is then POSTed to `/j_security_check` (the servlet-container form-authentication endpoint), processed by CustomSSOAuthHandler, and results in an authenticated session under the victim's identity — without ever supplying a password.

Three layered controls make blind, remote, internet-scale exploitation impractical despite the CVSS 9.0 base score: (1) a server-to-server handshake on the GET_SSO_TICKET_DETAILS resolver requiring a random UUID handshake key that rotates every 120 seconds, closing off a direct timestamp-oracle attack; (2) source-IP binding keyed on the raw socket address (not the spoofable X-Forwarded-For header, in default configuration, though a misconfigured TRUSTED_IPS setting could reintroduce spoofing risk); and (3) IAM security-filter request throttling (the IAMSecurityException / URL_ROLLING_THROTTLES_LIMIT_EXCEEDED control) capping roughly 40 requests per 60 seconds per request-path-plus-source-IP, with a further 60-second lockout on violation. These combine to require an attacker to already share an IP/NAT boundary or have a foothold on the victim's internal network, to predict the login timing within roughly a one-second window, and to sustain a throttled guessing campaign of around 25 minutes while the legitimate ticket remains cached — a noisy, slow, and log-visible attack rather than a mass unauthenticated internet exploit.

Bishop Fox's companion open-source detection tool (CVE-2026-11374-check, Python) confirms the AD360-integration precondition remotely and unauthenticated by sending a deliberately invalid CUSTOM_SSO_TICKET=1700000000000 cookie paired with CUSTOM_SSO_APP_TAG_NAME=AD360 to a CustomSSO URL pattern and inspecting the response for cookie-cleanup Set-Cookie headers (CUSTOM_SSO_TICKET=removed, CUSTOM_SSO_APP_NAME=removed, CUSTOM_SSO_APP_TAG_NAME=removed with Max-Age=0), cross-referenced against product-specific Tomcat session-cookie names (JSESSIONIDADSSP, JSESSIONIDADAP, JSESSIONIDM365MP, JSESSIONIDRMP) and build-number query parameters (?build= for ADSelfService Plus, ?v= for ADAudit Plus, ?bN= for M365 Manager Plus; RecoveryManager Plus exposes none). Default product ports are 8888 (ADSelfService Plus), 8081 (ADAudit Plus), 8365 (M365 Manager Plus), and 8090 (RecoveryManager Plus).

The issue was privately reported by security researcher 0xmanhnv through the Zoho BugBounty program. Zoho/ManageEngine's patched code replaces the timestamp-derived ticket with `String ticketId = UUID.randomUUID().toString();`, providing roughly 122 bits of SecureRandom entropy, and shipped fixes across the four affected products between June 3 and June 12, 2026 (ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817, ADAudit Plus 8703). Bishop Fox published an independent technical analysis and the detection/precondition-check tool on July 21, 2026, confirming end-to-end exploitability in a controlled lab while cautioning defenders that the realistic risk profile is a targeted, network-positioned attacker rather than opportunistic mass scanning. No confirmed in-the-wild exploitation has been reported as of this analysis.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1589 Gather Victim Identity Information
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1539 Steal Web Session Cookie
- T1606 Forge Web Credentials
- T1110 Brute Force
- T1110.004 Credential Stuffing
- T1550.004 Web Session Cookie
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1078.002 Domain Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-11374 — CUSTOM_SSO_TICKET Millisecond-Window Cookie Enumeration** (`TL-2026-1627-SPL-001`)

Detects a single source IP sending a burst of GET requests to AD360-integrated *.do / showLogin.cc endpoints carrying CUSTOM_SSO_TICKET cookie values that differ only in low-order milliseconds within a ~1 second window — the observable footprint of predictable-token guessing against CookieSSOImpl/TicketHandler.getTicket() (CWE-330 insufficient randomness).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1539, T1110
- **Data sources:** manageengine_access_log, web_proxy, load_balancer_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web_proxy sourcetype="manageengine:access" (uri_path="*/AppsHome.do*" OR uri_path="*/showLogin.cc*")
| rex field=cookie "CUSTOM_SSO_TICKET=(?<ticket_id>\d{13})"
| where isnotnull(ticket_id)
| eval ticket_ms=ticket_id
| bucket _time span=1s
| stats count as ticket_attempts, dc(ticket_ms) as distinct_tickets, min(ticket_ms) as min_ticket, max(ticket_ms) as max_ticket by src_ip, _time
| eval ticket_spread_ms = max_ticket - min_ticket
| where ticket_attempts > 10 AND ticket_spread_ms <= 1000
| sort - ticket_attempts
```

### Microsoft KQL

```kql
let lookback = 24h;
WebRequests_CL
| where TimeGenerated > ago(lookback)
| where RequestPath_s has_any ("/AppsHome.do", "/showLogin.cc")
| extend ticket_id = extract(@"CUSTOM_SSO_TICKET=(\d{13})", 1, tostring(Cookie_s))
| where isnotempty(ticket_id)
| summarize TicketAttempts = count(), DistinctTickets = dcount(ticket_id), MinTicket = min(toint(ticket_id)), MaxTicket = max(toint(ticket_id)) by SourceIP_s, bin(TimeGenerated, 1s)
| extend TicketSpreadMs = MaxTicket - MinTicket
| where TicketAttempts > 10 and TicketSpreadMs <= 1000
| project TimeGenerated, SourceIP_s, TicketAttempts, DistinctTickets, TicketSpreadMs
```

### Sigma

```yaml
title: CUSTOM_SSO_TICKET Rapid Millisecond-Window Cookie Enumeration
id: 3c7d9f21-4e8a-4b1c-9a2f-6e0d3b8c5a17
status: experimental
description: Detects a burst of CUSTOM_SSO_TICKET cookie values from a single source IP that differ only in low-order milliseconds, consistent with ticket-timestamp guessing against CVE-2026-11374 (predictable SSO ticket generation in ManageEngine AD360-integrated products).
references:
    - https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit
    - https://github.com/BishopFox/CVE-2026-11374-check
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.credential-access
    - attack.t1539
    - attack.t1110
    - attack.initial-access
    - attack.t1190
    - cve.2026.11374
logsource:
    category: webserver
    product: manageengine
detection:
    selection:
        cs_cookie|contains: 'CUSTOM_SSO_TICKET='
        request_path|contains:
            - '/AppsHome.do'
            - '/showLogin.cc'
    timeframe: 1s
    condition: selection | count(cs_cookie) by src_ip > 10
falsepositives:
    - Load balancer or WAF health probes replaying stale session cookies
    - Authorized use of the Bishop Fox CVE-2026-11374-check precondition-check tool
level: high
```

**Known false positives:**

- Load balancer or CDN health checks replaying stale/cached session cookies at high frequency
- Authorized internal use of the Bishop Fox CVE-2026-11374-check scanning tool during a patching-window audit

**Tuning notes:** Tune the count>10 / 1s-window thresholds to the environment's normal SSO retry rate; exclude known vulnerability-scanner source IPs (e.g. an internal Bishop Fox CVE-2026-11374-check runner) via an allowlist macro rather than disabling the rule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-11374 — Bishop Fox Canary-Cookie Precondition-Check Probe (locked: unlock with TL Creds)
- CVE-2026-11374 — Post-Takeover Identity, Role, and Domain Disclosure via Discovery Requests (locked: unlock with TL Creds)
- CVE-2026-11374 — [indicator] (locked: unlock with TL Creds)
- CVE-2026-11374 — IAMSecurityException Throttle-Limit Violation on SSO Endpoints (locked: unlock with TL Creds)
- CVE-2026-11374 — Build-Number Fingerprinting of AD360-Integrated Products by Unauthenticated Source (locked: unlock with TL Creds)
- CVE-2026-11374 — Successful 401-then-200 CUSTOM_SSO_TICKET Sequence Establishing an Authenticated Session (locked: unlock with TL Creds)
- CVE-2026-11374 — Post-Guess Auto-Submit Form Retrieval Immediately Followed by j_security_check POST (locked: unlock with TL Creds)
- CVE-2026-11374 — Source-IP-Binding Bypass via Spoofed X-Forwarded-For on SSO Endpoints (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit](https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit)
- [CVE-2026-11374 detection tool (BishopFox)](https://github.com/BishopFox/CVE-2026-11374-check)
- [CVE-2026-11374: Account takeover vulnerability in ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus](https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html)
- [ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability](https://gbhackers.com/manageengine-ad360-account-takeover-vulnerability/)
- [ManageEngine AD360 Flaw Lets Unauthenticated Attackers Take Over User Accounts](https://cyberpress.org/manageengine-ad360-flaw/)
- [ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers](https://cybersecuritynews.com/manageengine-ad360-integration-flaw/)
- [CVE-2026-11374 - Account Takeover via Predictable SSO Ticket Generation](https://cvefeed.io/vuln/detail/CVE-2026-11374)
- [Zoho Corp. ManageEngine: Critical SSO vulnerability allows account takeover](https://www.heise.de/en/news/Zoho-Corp-ManageEngine-Critical-SSO-vulnerability-allows-account-takeover-11342963.html)
- [ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers](https://www.cryptika.com/manageengine-ad360-integration-flaw-exposes-user-identity-and-role-information-to-attackers/)
- [Weekly Threat Landscape Digest - Week 25](https://hawk-eye.io/2026/06/weekly-threat-landscape-digest-week-25-2/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1627