SAML Authentication Bypass in ManageEngine Key Manager Plus
CVE-2026-77800

7.7HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Key Manager Plus
Vendor
CVE Published:
3 November 2026

What is CVE-2026-77800?

ManageEngine Key Manager Plus is vulnerable to a SAML authentication bypass, enabling attackers to exploit SAML assertions intended for different service providers. This flaw could potentially allow unauthorized access to sensitive resources, underscoring the importance of timely updating to the latest version. For additional information, refer to the advisory provided by ManageEngine.

Affected Version(s)

ManageEngine Key Manager Plus 0 < 7151

References

https://www.manageengine.com/key-manager/advisory/cve-202...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.