A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit

TL;DR

CVE-2026-11374">CVE-2026-11374 is a critical, unauthenticated account takeover that hands an attacker any session, administrators included, on ManageEngine’s Active Directory management platform. Because the SSO ticket is just the millisecond wall-clock time at login, an attacker who predicts that instant can replay it as a cookie and inherit the victim’s session. Blind exploitation is still impractical, though. Several layered controls box the attack into a narrow window, so the realistic threat is a targeted attacker already on the victim’s network, not opportunistic scanning. The bug affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus under AD360, so patch to the latest build. But the patch only goes halfway. It removes the ticket’s predictability while leaving it a non-HttpOnly, long-lived bearer token, so a stolen ticket still works on a patched host, and hardening the SSO cookie yourself is the other half of the fix. Our detection tool is on CVE-2026-11374-check">GitHub.…