CVE-2026-77777: Improper access control vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77777

Details :
CVE-2026-77777 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with certificate management privileges could modify the deployment credentials associated with another user's ACME certificate mapping.

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An authenticated user who successfully exploits this vulnerability could cause another user's certificates and private keys to be deployed to a server the attacker controls, potentially enabling service impersonation or unauthorized certificate based authentication.

Fix:This issue has been resolved by validating the requesting user's access privileges against the selected certificate mapping before the associated deployment credentials can be modified.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by sealldev through the Zoho BugBounty program..

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com