CVE-2026-77800: Authentication bypass vulnerability in Key Manager Plus

Severity : High

CVE ID: CVE-2026-77800

Details :
CVE-2026-77800 refers to a security vulnerability reported in ManageEngine Key Manager Plus. When single sign-on is configured, an unauthenticated attacker holding a SAML assertion issued by the same identity provider for a different service provider could submit it to Key Manager Plus.

Product Name	Affected Version(s)	Fixed Version(s)	Fixed On
Key Manager Plus	All versions until 7150	7151	Aug 21, 2026

Impact:
An attacker who successfully exploits this vulnerability could obtain an authenticated session as an existing Key Manager Plus user without that user's password. Where the assertion identifies an administrator, this could grant access to all application functions available to that role.

Fix:This issue has been resolved by validating the intended audience of SAML assertions during single sign-on authentication.

Steps to Upgrade:

Download the latest upgrade pack from the following links for the respective products:
- Key Manager Plus - https://www.manageengine.com/key-manager/upgradepack.html
Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements:

This issue was reported by sealldev through the Zoho BugBounty program..

Please contact the product support for further details at the below mentioned email addresses:

Key Manager Plus: keymanagerplus-support@manageengine.com