ManageEngine Key Manager Plus Improper Access Control on ACME Credentials
CVE-2026-77777 Published on November 3, 2026
Improper access control vulnerability
ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
Vulnerability Analysis
CVE-2026-77777 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Products Associated with CVE-2026-77777
Want to know whenever a new CVE is published for Zoho Corp Manageengine Key Manager Plus? stack.watch will email you.
Affected Versions
Zohocorp ManageEngine Key Manager Plus:- Before 7151 is affected.