CVE-2026-77779: Command injection vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77779

Details :
CVE-2026-77779 refers to a security vulnerability reported in ManageEngine Key Manager Plus. An authenticated user with limited privileges could export keys outside their authorized scope.

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An authenticated low privileged user who successfully exploits this vulnerability could retrieve certificates and their associated private keys stored in Key Manager Plus, including those belonging to other users, potentially enabling impersonation or signature forgery.

Fix:This issue has been resolved by enforcing stringent authorization checks on agent-initiated certificate requests, ensuring an agent can only act on jobs and certificates within the scope of the user that registered it.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by teddy ctf through the Zoho BugBounty program.

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com