CVE-2026-77778: Improper access control vulnerability

Published Nov 3, 2026

Updated

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

Event History

Nov 3, 2026

CVE Published

via MITRE·09:42 AM

Data Sourced

via MITRE·09:42 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit it. The user needs access to ManageEngine Key Manager Plus and a registered key vault under their control.

What access is exposed if exploitation succeeds?

The attacker can export certificates that belong to other users into the attacker’s own registered key vaults. This can result in disclosure of certificate material and may affect integrity across a changed security scope.

Which versions are affected?

ManageEngine Key Manager Plus versions up to 7150 are affected.

CVE-2026-77778: Improper access control vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access is exposed if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access is exposed if exploitation succeeds?

Which versions are affected?