# CVE-\<phone_number_or_numberic_id_or_random_id_1\>

**Exposure of a Google Cloud service-account private key in the Applications Manager installer.**

| Vulnerability Details |  |
|---|---|
| Severity | **Critical** |
| CVE ID | CVE-\<phone_number_or_numberic_id_or_random_id_1\> |
| Affected software versions | Version 182200 and below |
| Fixed Version | Version 182300 and above<br>Version 181104 to 181109<br>Version 182001 to 182009 |
| Fixed On | 08 September 2026 |

## Details

The Applications Manager installer included a Google Cloud service-account private key with broader-than-required permissions. The key is used to send push notifications, and an unauthenticated attacker who obtained the public installer could potentially extract and misuse the key to impersonate the service account.

## Impact

The excessive permissions could allow an attacker to access or modify cloud resources associated with Applications Manager beyond what is required for push notifications. This could affect application data, project configuration, storage, messaging, or other cloud services outside Applications Manager.

## Fix

Applications Manager version 182300 (refer above for other fixed versions) and above fixes this issue by replacing the existing key with a new encrypted key that has only the permissions required for push notifications.

## Steps to update

Update your Applications Manager instance to the latest build using the service pack.

## Source and Acknowledgements

Find out more about CVE-\<phone_number_or_numberic_id_or_random_id_1\> from [CVE Directory](https://www.cve.org/CVERecord?id=CVE-2026-86708) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-86708)

## Reported by:

Zeocrynt

### Need Help?

For clarification or corrections please contact our [support team](https://www.manageengine.com/products/applications_manager/support.html) or email us at [appmanager-support@manageengine.com](mailto:appmanager-support@manageengine.com)