CVE-2026-77778: Improper access control vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77778

Details :
CVE-2026-77778 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with certificate management privileges could export a certificate belonging to another user to a key vault registered by the requesting user

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An authenticated user who successfully exploits this vulnerability could obtain certificates and their associated private keys belonging to other users, potentially enabling impersonation.

Fix:This issue has been resolved by validating the requesting user's access privileges against the selected certificate before it is exported to a registered key vault.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by sealldev through the Zoho BugBounty program..

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com