CVE-2026-11374

Executive Summary

CVE-2026-11374 is a critical vulnerability affecting multiple ManageEngine products: ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus. The flaw lies in the generation of SSO tickets used to authenticate user sessions. An unauthenticated attacker can predict these tickets, leading to full account takeover. With a CVSS score of 9.0, this vulnerability poses a severe risk to organizations relying on these identity and access management solutions. No public proof-of-concept or patch is currently available, but the high severity demands immediate attention.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects proprietary ManageEngine software, which is typically deployed on-premises or in private cloud environments. Organizations should verify the integrity of their ManageEngine installations and monitor for any unofficial patches or updates.

CVSS Breakdown & Threat Level

• CVSS Score: 9.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the lack of required privileges, low complexity, and the potential for complete account takeover. An attacker can compromise any user account, including administrative ones, without any prior access.

Deep Dive & Mechanics

The vulnerability stems from weak randomness in the generation of SSO tickets. ManageEngine products use a predictable algorithm or seed to create these tokens, allowing an attacker to enumerate or brute-force valid tickets. Once a valid SSO ticket is obtained, the attacker can impersonate the legitimate user and gain full access to the application.

The SSO ticket is typically generated upon user authentication and is used to maintain the session. If the ticket is predictable, an attacker can:

1. Observe a few valid tickets (e.g., by capturing network traffic or using a known user session).
2. Analyze the pattern to predict future tickets.
3. Use a predicted ticket to hijack an active session or authenticate as a different user.

This is a classic example of CWE-330: Use of Insufficiently Random Values.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior. The vulnerable code likely uses a weak random number generator (e.g., java.util.Random instead of java.security.SecureRandom) or a predictable seed (e.g., timestamp or user ID).

Vulnerable (pseudocode):

// Weak random generation
Random rand = new Random();
String ticket = String.valueOf(rand.nextLong());

Patched (expected):

// Secure random generation
SecureRandom secureRand = new SecureRandom();
byte[] bytes = new byte[32];
secureRand.nextBytes(bytes);
String ticket = Base64.getEncoder().encodeToString(bytes);

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable ManageEngine ADSelfService Plus instance (version unknown, but any version before patch).
2. Set up a test user account.
3. Use a network sniffer (e.g., Wireshark) to capture SSO tickets during login.

Exploitation Steps:

1. Capture a few SSO tickets from legitimate user sessions.
2. Analyze the tickets to identify the pattern (e.g., incremental values, timestamp-based).
3. Write a script to predict the next ticket for a target user.
4. Use the predicted ticket to access the application as that user.

Example Python script (conceptual):

import requests

# Assume tickets are sequential integers
base_url = "https://target.com"
predicted_ticket = 12345  # Predicted from analysis

# Use the predicted ticket to authenticate
session = requests.Session()
session.cookies.set("SSO_TICKET", str(predicted_ticket))
response = session.get(f"{base_url}/dashboard")
if response.status_code == 200:
    print("Account takeover successful!")

Blue Team

Detection:

• Monitor for multiple failed login attempts followed by a successful login from the same IP.
• Look for unusual patterns in SSO ticket generation (e.g., sequential tickets).
• Alert on any use of SSO tickets that do not match the expected format or length.

Hunting:

• Search logs for SSO ticket values that are simple integers or timestamps.
• Correlate SSO ticket usage with user activity to detect anomalies.

Indicators of Compromise (IOCs)

• Network: Unusual number of SSO ticket requests from a single IP.
• Logs: SSO tickets that are sequential or follow a predictable pattern.
• Behavior: Account access from unexpected locations or times without prior authentication.

Example IOC (log entry):

[2026-01-15 10:00:00] SSO_TICKET: 1001 for user admin
[2026-01-15 10:00:01] SSO_TICKET: 1002 for user admin

Detection Engineering

YARA Rule

rule Detect_Weak_SSO_Ticket {
    meta:
        description = "Detects weak SSO ticket patterns in ManageEngine logs"
        author = "Valters IT"
        date = "2026-01-15"
    strings:
        $ticket_pattern = /SSO_TICKET:\s*\d{4,10}/  // Sequential numeric tickets
    condition:
        $ticket_pattern
}

Sigma Rule

title: Detect Predictable SSO Ticket Usage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects sequential or predictable SSO tickets in ManageEngine logs
author: Valters IT
logsource:
    product: manageengine
    service: adselfservice
detection:
    selection:
        EventID: 4624  // Logon event
        TicketValue|re: '^\d{4,10}$'  // Numeric ticket
    condition: selection
falsepositives:
    - Legitimate sequential tickets if system is misconfigured
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Potential SSO Ticket Prediction Attack"; flow:to_server; content:"SSO_TICKET"; nocase; pcre:"/SSO_TICKET=\d{4,10}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable SSO functionality if not critical.
   • Restrict network access to ManageEngine servers.
   • Enable multi-factor authentication (MFA) to mitigate account takeover.

2. Long-term Fix:

   • Apply vendor patch as soon as it becomes available.
   • If patching is not possible, implement a Web Application Firewall (WAF) rule to block suspicious ticket patterns.
   • Monitor vendor advisories for updates.

3. Workarounds:

   • Use a reverse proxy to add additional authentication layers.
   • Implement rate limiting on SSO ticket generation endpoints.

Valters IT