CVE-2026-77691: Command injection vulnerability
Published Nov 3, 2026
·Updated
ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA
Event History
Nov 3, 2026
CVE Published
via MITRE·09:50 AM
Data Sourced
via MITRE·09:50 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
ManageEngine Key Manager Plus deployments running versions before 7151 are affected when Microsoft CA configuration is available to users.
2
What does an attacker need to exploit this issue?
The attacker needs authenticated access and the ability to provide input while configuring a Microsoft CA. No user interaction is required.
3
What is the remediation?
Upgrade ManageEngine Key Manager Plus to version 7151 or later. The vulnerability affects versions before 7151.