Bottom line: Four ManageEngine products contain a critical vulnerability that allows unauthenticated attackers to perform account takeovers via manipulated SSO mechanisms.
A critical vulnerability in four ManageEngine products allows unauthenticated attackers to hijack user accounts through predictable Single Sign-On tickets. The vendor has already released updates.
Four products from the ManageEngine portfolio are affected. The vulnerability is based on predictable Single Sign-On tickets that can be exploited in combination with ManageEngine AD360. Without valid credentials, attackers can hijack third-party accounts.
For a CISO, this represents a significant risk in the identity and access management infrastructure: if SSO mechanisms are compromised through weak ticket generation, an attacker can move laterally into systems and operate with the privileges of other users — with potentially critical consequences for compliance and data protection.
ManageEngine has released updates. At the current time, no active exploits in the field are known. Security patch management should nevertheless be prioritized highly, especially if these systems handle central authentication tasks in the network.
Source: www.security-insider.de · Published 3 July 2026
Lumi AI News — AI-assisted curation according to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.