CVE-2026-77799: Two-factor authentication bypass
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ManageEngine Key Manager Plusto a version that resolves this vulnerability.Fixed in 7150
Event History
Frequently Asked Questions
Which deployments are affected?
ManageEngine Key Manager Plus versions before 7150 are affected. Version 7150 is the first version not identified as vulnerable in the provided advisory data.
What does an attacker need to exploit this issue?
An attacker needs valid credentials and network access to the affected Key Manager Plus instance. No user interaction is required, and the attacker can log in without supplying a verification code.
What is the likely impact after exploitation?
The issue can result in high confidentiality and integrity impact. No availability impact is indicated.