Improper Access Control Vulnerability in ManageEngine Key Manager Plus
CVE-2026-77777

7.1HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Key Manager Plus
Vendor
CVE Published:
3 November 2026

What is CVE-2026-77777?

ManageEngine Key Manager Plus, prior to version 7151, is susceptible to an improper access control vulnerability. This flaw enables authenticated users to alter the ACME certificate deployment credentials of other users, potentially leading to unauthorized access and altered configurations. Organizations using affected versions are encouraged to upgrade promptly to mitigate potential risks associated with this vulnerability.

Affected Version(s)

ManageEngine Key Manager Plus 0 < 7151

References

https://www.manageengine.com/key-manager/advisory/cve-202...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.