CVE-2026-77777: High severity vulnerability
ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated user of ManageEngine Key Manager Plus. The issue affects versions before 7151.
What access is required to exploit the vulnerability?
The attacker needs low-level privileges and does not require user interaction. Exploitation is network-accessible, but the attack complexity is rated high.
What could an attacker do if exploitation succeeds?
An authenticated attacker could modify another user's ACME certificate deployment credentials. The listed impact includes high confidentiality impact and low integrity impact, with no availability impact.
What version should organizations upgrade to?
Organizations should update ManageEngine Key Manager Plus to version 7151 or later, because versions before 7151 are affected.