Key Manager Plus Auth Export Privilege Escalation
CVE-2026-77778 Published on November 3, 2026
Improper access control vulnerability
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
Vulnerability Analysis
CVE-2026-77778 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Products Associated with CVE-2026-77778
Want to know whenever a new CVE is published for Zoho Corp Manageengine Key Manager Plus? stack.watch will email you.
Affected Versions
Zohocorp ManageEngine Key Manager Plus:- Before 7151 is affected.