ManageEngine has disclosed a high-severity vulnerability, tracked as CVE-2026-11374, affecting several of its identity and access management solutions when integrated with AD360. The flaw could allow unauthenticated attackers to predict single sign-on (SSO) tokens , potentially leading to account takeover and exposure of sensitive user information. The issue affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when deployed within the ManageEngine AD360 environment. These tools are commonly used across enterprise networks for identity governance, Active Directory management , auditing, and Microsoft 365 administration, making the vulnerability particularly significant in large-scale deployments. ManageEngine AD360 Integration Flaw The vulnerability was reported by security researcher 0xmanhnv through the Zoho BugBounty program, and ManageEngine has credited the researcher for the responsible disclosure. According to the advisory, the vulnerability stems from weaknesses in the generation of SSO tickets during authentication. When a user logs in via AD360’s SSO, the system issues a token to validate the session. However, researchers found that an unauthenticated attacker could predict these tokens. This predictability opens the door for attackers to craft valid session tokens without needing legitimate credentials. Exploitation of this flaw could allow attackers to impersonate users and gain unauthorized access to systems. In such scenarios, attackers may retrieve user identity details and role-based access information, which could, in turn, enable privilege escalation depending on the compromised account. In environments where AD360 acts as a central identity hub, this risk becomes more severe as multiple integrated services could be exposed through a single successful attack. An attacker could generate a valid SSO token to gain unauthorized access to ADAudit Plus audit logs and administrative data, enabling internal reconnaissance and potential lateral movement within the organization. The vulnerability affects ADSelfService Plus version 6528 and earlier, RecoveryManager Plus version 6320 and earlier, M365 Manager Plus version 4816 and earlier, and ADAudit Plus version 8702 and earlier. ManageEngine has released patches to address the issue in subsequent versions released between June 3 and June 12, 2026. To mitigate the risk, ManageEngine has strengthened the SSO ticket generation mechanism to ensure tokens are no longer predictable. Organizations using affected products are strongly advised to apply the latest service packs immediately to secure their environments. In addition to patching, security teams should closely monitor authentication logs for unusual SSO activity and review access permissions across critical accounts. Strengthening access controls and limiting exposure of identity services can further reduce the risk of exploitation. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers appeared first on Cyber Security News .

Zohoが提供する「ManageEngine」の複数製品において認証回避の脆弱性が明らかとなった。6月前半に公開されたアップデートで修正済みだという。 ：Security NEXT

Introduction: A critical security vulnerability identified as CVE-2026-11374 has been disclosed in ManageEngine's AD360 identity and access management suite, affecting multiple integrated products including ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus. The flaw stems from weaknesses in SSO ticket generation, allowing unauthenticated attackers to predict valid session tokens and potentially take over user accounts. With a CVSS score of 9.0 and classification as "critical," this vulnerability poses significant risks to enterprises relying on AD360 as a central identity hub.

A high-severity vulnerability, tracked as CVE-2026-11374, has been disclosed in multiple ManageEngine products, ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, when deployed as integrated components within the ManageEngine AD360 suite.

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CopBlaster.com has lost the ability to edit the source code of this website due to a misleading stat... #copblaster #hewlettpackard #microsoft #visualstudio

ManageEngine has disclosed a high-severity vulnerability, tracked as CVE-2026-11374, affecting several of its identity and access management solutions when integrated with AD360. The flaw could allow unauthenticated attackers to predict single sign-on (SSO) tokens, potentially leading to account takeover and exposure of sensitive user information. The issue affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, [...] The post ManageEngine AD360 Integration Flaw Exposes User Identity and Role Information to Attackers appeared first on Cyber Security News .

Hello! I have a problem with autocad recoverymanager. After a systemcrash I cannot find the autosaves I can find on my harddisk. There are 5 drawings with autosave, of which 3 have a bak file and 2 don't (?) How can I recover these files?