CVE-2026-77691: Command injection vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77691

Details :
CVE-2026-77691 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with certificate management privileges could supply specially crafted input while configuring a Microsoft CA, which could later be used during the certificate revocation process.

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An authenticated user who successfully exploits this vulnerability could execute arbitrary operating system commands on a Windows endpoint where the certificate agent is installed, with the privileges of the agent service.

Fix:This issue has been resolved by validating and sanitizing the input used during certificate revocation, ensuring that user supplied values can no longer influence command execution on the certificate agent host.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by sealldev through the Zoho BugBounty program.

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com