CVE-2026-86708

Exposure of a Google Cloud service-account private key in the Applications Manager installer.

Details

The Applications Manager installer included a Google Cloud service-account private key with broader-than-required permissions. The key is used to send push notifications, and an unauthenticated attacker who obtained the public installer could potentially extract and misuse the key to impersonate the service account.

Impact

The excessive permissions could allow an attacker to access or modify cloud resources associated with Applications Manager beyond what is required for push notifications. This could affect application data, project configuration, storage, messaging, or other cloud services outside Applications Manager.

Fix

Applications Manager version 182300 (refer above for other fixed versions) and above fixes this issue by replacing the existing key with a new encrypted key that has only the permissions required for push notifications.

Steps to update

Update your Applications Manager instance to the latest build using the service pack.

Source and Acknowledgements

Find out more about CVE-2026-86708 from CVE Directory and NIST NVD

Reported by:

Zeocrynt

Need Help?

For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com