CVE-2026-77799: Two-factor authentication bypass vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77799

Details : 
CVE-2026-77799 refers to a security vulnerability reported in ManageEngine Key Manager Plus. When two-factor authentication is enabled, an attacker in possession of a valid username and password could obtain an authenticated session directly through a specific authentication endpoint.

Product NameAffected Version(s)Fixed Version(s)Fixed On
Key Manager PlusAll versions until 71507151Aug 21, 2026

Impact:
An attacker with valid user credentials could sign in to Key Manager Plus without providing the second authentication factor, obtaining a session with that user's role and the access it carries.

Fix:This issue has been resolved by enforcing the second authentication factor across all authentication request paths.

Steps to Upgrade:

  1. Download the latest upgrade pack from the following links for the respective products:
  2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by SolidScripting through the Zoho BugBounty program.

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com