CVE-2026-77690: Command injection vulnerability
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZohoCorp ManageEngine Key Manager Plusto a version that resolves this vulnerability.Fixed in 7151
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with certificate deployment privileges can exploit it. The attacker must be able to configure a certificate deployment target and supply specially crafted input.
Which deployments are affected?
ManageEngine Key Manager Plus versions before 7151 are affected. Version 7151 and later are not identified as vulnerable by the provided advisory information.
What access could an attacker gain through successful exploitation?
Successful exploitation allows arbitrary command execution. The reported impact includes high confidentiality, integrity, and availability consequences.