Predictable SSO Tickets Enable Unauthenticated Account Takeover

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ManageEngine's suite of administrative tools—ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus—contains a critical authentication bypass vulnerability where Single Sign-On (SSO) session tickets can be predicted by unauthenticated attackers. This weakness in cryptographic randomness (CWE-330, CWE-340) combined with broken authentication mechanisms (CWE-287) allows adversaries to forge valid session credentials without ever obtaining legitimate credentials. Organizations managing Active Directory, Microsoft 365, or audit operations through these platforms face immediate risk of complete account takeover, lateral movement, and unauthorized access to sensitive identity and compliance data.

Casky's 283 matched skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would see findings highlighting predictable token generation patterns, SSO ticket forgery attempts, and unauthenticated session establishment—detecting adversaries crafting malicious tickets to impersonate legitimate users. The platform's skill mapping would identify reconnaissance activity probing for SSO endpoint vulnerabilities, followed by attempts to authenticate using predicted tickets, enabling security teams to catch exploitation before account compromise occurs. This combination of cryptographic weakness detection and authentication bypass pattern recognition provides defense-in-depth visibility into both the vulnerability mechanics and real-world attack chains targeting ManageEngine deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11374.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-11374

Casky has 283 skills that investigate the attack patterns behind CVE-2026-11374. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn