Skip to content
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
bishopfox.com | vulnerability | Critical | CVE-2026-11374 | #featured | #vulnerability-research | #account-takeover | #active-directory | #authentication-bypass | #manageengine | #sso | #patch-analysis | #cve-2026-11374
Summary
Bishop Fox analyzes CVE-2026-11374, a timing-dependent but critical unauthenticated account-takeover path across four AD360-integrated ManageEngine products. Fixed builds are ADSelfService Plus 6529, RecoveryManager Plus 6321, M365 Manager Plus 4817 and ADAudit Plus 8703.
Why it matters
The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.
- Vendor
- ManageEngine
- Product
- AD360-integrated products
- Affected versions
- ADSelfService Plus < 6529; RecoveryManager Plus < 6321; M365 Manager Plus < 4817; ADAudit Plus < 8703
- CVSS
- 9
- Published
- Collected