# CVE-2026-77778: Improper access control vulnerability in Key Manager Plus

**Severity:** High

**CVE ID:** CVE-2026-77778

**Details:**

CVE-2026-77778 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with certificate management privileges could export a certificate belonging to another user to a key vault registered by the requesting user.

| Product Name | Affected Version(s) | Fixed Version(s) | Fixed On |
|---|---|---|---|
| Key Manager Plus | All versions until 7150 | [7151](https://www.manageengine.com/key-manager/upgradepack.html) | Aug 21, 2026 |

**Impact:**

An authenticated user who successfully exploits this vulnerability could obtain certificates and their associated private keys belonging to other users, potentially enabling impersonation.

**Fix:** This issue has been resolved by validating the requesting user's access privileges against the selected certificate before it is exported to a registered key vault.

## Steps to Upgrade

1. Download the latest upgrade pack from the following links for the respective products:
   - Key Manager Plus - [https://www.manageengine.com/key-manager/upgradepack.html](https://www.manageengine.com/key-manager/upgradepack.html)
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

## Acknowledgements

This issue was reported by **sealldev** through the Zoho BugBounty program..

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: [keymanagerplus-support@manageengine.com](mailto:keymanagerplus-support@manageengine.com)