CVE-2026-77690: Command injection vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77690

Details :
CVE-2026-77690 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with certificate deployment privileges could supply specially crafted input while configuring a deployment target.

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An authenticated user who successfully exploits this vulnerability could execute arbitrary operating system commands on the configured deployment target with the privileges of the deployment identity.

Fix:This issue has been resolved by validating and sanitizing the input used during certificate deployment, ensuring that user supplied values can no longer influence command execution on the target host.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by sealldev through the Zoho BugBounty program.

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com